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ABSTRACT 


Colombia  has  been  in  the  midst  of  peace  talks  with  the  Revolutionary  Armed 
Forces  of  Colombia  (FARC)  since  201 1 .  This  process  could  follow  the  trend  in 
attempted  resolutions  of  other  internal  armed  conflicts  in  Latin  American 
countries  such  as  Guatemala,  El  Salvador,  and  Nicaragua.  These  Central- 
American  countries  experienced  peaks  in  violence  and  the  emergence  of  splinter 
criminal  groups  after  their  respective  governments  reached  agreements  with  the 
guerrillas.  A  similar  situation  can  occur  in  Colombia,  particularly  if  a  hardline 
subgroup  from  the  FARC  does  not  want  to  commit  to  peace  agreements.  This 
research  focuses  on  the  set  of  terrorists  that  will  continue  their  activities  by 
forming  alliances  with  criminal  groups.  In  order  to  understand  this  potential  risk, 
this  research  uses  social  network  analysis  techniques  on  three  recent  cases  of 
terrorist-criminal  association,  in  which  the  FARC  has  subcontracted  criminal 
organizations  to  conduct  operations  on  its  behalf.  The  analysis  sheds  light  on  the 
social  structure  of  these  networks,  their  actors’  centrality,  the  organizations’ 
centralization,  and  their  transformation  over  time.  The  results  of  this  analysis 
contribute  to  identify  some  important  considerations  to  strengthen  the  state  and 
the  nation’s  security. 
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I.  INTRODUCTION 


A.  BACKGROUND 

Peace  processes  are  the  most  effective  way  to  end  internal  armed 
conflicts.''  They  seek  to  address  the  social,  economic,  and  political  causes  that 
give  birth  to  violence.  Nevertheless,  recent  Latin  American  history  reveals 
moments  of  tension  during  the  consolidation  of  signed  agreements  between  the 
parties.  These  moments  manifest  themselves  in  acts  of  violence,  such  as 
selective  homicides  and  terrorism.  In  other  cases,  they  have  generated  splinter 
groups  that  seek  to  conduct  criminal  or  terrorist  activities  independently. 

An  example  of  diminishing  security  was  apparent  at  the  end  of  the 
Nicaragua’s  internal  armed  conflict  in  1990.  Notwithstanding  efforts  to  reset  the 
country  economically  and  to  create  mechanisms  of  social  equality,  some  sectors 
that  did  not  benefit  by  the  agreed  measures  experienced  significant  breakouts  of 
violence.  It  is  estimated  that  between  1990  and  1996  “armed  bands  roaming  the 
countryside  were  responsible  for  an  estimated  1,000  deaths  and  600 
kidnappings. ”2  In  El  Salvador  violence  was  similar  and  complex.  Impoverished 
rural  areas  were  the  most  affected,  perhaps  influenced  by  the  unemployment 
rate  that  nearly  reached  80  percent  of  population  in  the  early  1990s. 3  A  study 
published  by  the  Inter-American  Development  Bank  showed  that  El  Salvador  had 
the  highest  per  capita  homicide  rate  in  the  world  in  the  mid-1990s.4  Similarly, 
Guatemala  faced  extreme  conditions  of  violence  at  the  end  of  its  peace  process. 


''  Daniel  MatuI  and  Alonso  Ramirez,  “El  Proceso  De  Paz  En  Centroamerica.  Agendas 
Pendientes  y  Nuevos  Focos  De  Conflictividad:  Los  Casos  De  Guatemala  y  Nicaragua”  [Peace 
process  in  Central  America.  Pending  agendas  and  new  focuses  of  conflictivity:  The  cases  of 
Guatemala  and  Nicaragua],  Pensamiento  Propio,  no.  14  (Enero-Junio,  2009):  101-102. 

2  Roland  Paris,  At  War’s  End:  Building  Peace  after  Civil  Conflict  (New  York:  Cambridge 
University  Press,  2004),  118. 

3  Ibid.,  126 

^  Economist  Intelligence  Unit,  London  (GB),  Country  Profile  Guatemala  and  El  Salvador 
1996-97  996),  42. 
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Since  1996,  security  conditions  have  deteriorated  in  rural  zones  where  landlord- 
ownership  problems  were  not  resolved  in  the  peace  process  framework.  Some 
World  Bank  observers  have  informed  in  their  reports  that  “Guatemala  has 
become  a  substantially  more  violent  country  since  the  end  of  the  internal  armed 
conflict.”^ 

Currently,  Colombia  is  in  the  midst  of  peace  talks  with  the  Revolutionary 
Armed  Forces  of  Colombia  (FARC).  By  reaching  an  agreement  to  end  the 
conflict,  the  parties  will  generate  verification  mechanisms  to  comply  with  their 
commitments.  However,  previous  Latin-American  conflicts  show  that  tensions 
and  violence  are  frequently  part  of  the  outcome  in  peace  agreements.  Therefore, 
one  might  argue  that  these  events  may  also  happen  in  Colombia.^ 

A  recent  example  in  this  country  is  the  demobilization  of  the  United  Self- 
Defense  Groups  of  Colombia  (AUC),  which  were  comprised  of  40  subgroups 
between  the  years  2000  and  2006.  Of  these,  six  did  not  demobilize  and  most 
became  what  are  known  as  emergent  criminal  gangs  (BACRIM).'^  Their  formation 
was  caused  by  “the  fusion  of  several  generations  and  criminal  streams,  some 
with  and  others  without  ideological  reference  (counterinsurgency),  with  different 
levels  of  organizational  capacity  and  territorial  control. The  BACRIM  conduct 
criminal  activities  related  to  drug  trafficking,  extortion,  and  illegal  exploitation  of 
mineral  deposits. 


®  Caroline  O.  N.  Moser  and  Cathy  Mcliwaine,  Violence  in  a  Post-Conflict  Context:  Urban 
Poor  Perceptions  from  Guatemala  (Washington,  DC:  World  Bank  Publications,  2001),  13. 

®  Enzo  Nussio  and  Kimberly  Howe,  “What  if  the  FARC  Demobilizes?”  Stability:  International 
Journal  of  Security  and  Development  1,  no.  1  (2012):  58-67. 

^  Observatorio  de  Procesos  de  Desarme,  Desmovilizacion  y  Reintegracion,  Estructuras  De 
Autodefensa  y  Proceso  De  Paz  En  Colombia  [Self-defense  structures  and  peace  process  in 
Colombia]  (Bogota,  Colombia:  Universidad  Nacional  de  Colombia,  2012). 

®  Daniel  M.  Rico,  “Las  Dimensiones  Internacionales  Del  Crimen  Organizado  En  Colombia: 
Las  Bacrim,  Sus  Rutas  y  Refugios”  [The  international  dimension  of  organized  crime  in  Colombia: 
The  Bacrim,  their  routes  and  shelters].  La  Diaspora  Criminal:  La  Difusion  Transnacional  (2013), 
33. 
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B.  RESEARCH  CONTEXT 


The  historical  context  of  internal  conflicts  seems  to  culminate  with  patterns 
of  violence  and  a  transformation  of  criminal  actors.  This  thesis  argues  that  a 
hardline  sector  of  the  FARC  will  reject  the  peace  process  because  they  do  not 
trust  the  government’s  commitments  to  respect  human  rights  by  security  forces, 
which  could  ultimately  affect  their  personal  security.  Many  of  them  also  face  legal 
consequences  because  they  committed  crimes  during  their  membership  in  the 
organization.  Moreover,  they  might  find  it  unappealing  to  leave  behind  their 
criminal  activities  (drug  trafficking,  kidnapping,  extortion,  and  other  offenses)  that 
have  allowed  them  to  enjoy  a  wealthy  lifestyle.  These  patterns  of  behavior  are 
seen  frequently  during  demobilization  and  disengagement  processes  in 
Colombia,  and  are  contrary  to  the  process  of  consolidating  peace  agreements. ^ 

The  scope  of  this  thesis  focuses  on  the  FARC  members  who  do  not  want 
to  participate  in  the  peace  process  and  who  will  not  follow  procedures  of 
disarmament,  demobilization,  and  reintegration.  This  area  is  interesting  to 
analyze  from  the  viewpoint  of  terrorist-criminal  alliance  formation.  Alliances 
between  terrorists  and  criminals  are  processes  by  which  members  of  certain 
organizations  seek  to  expand  their  financial  capacity  and  ability  to  conduct 
violence  by  attracting  criminal  gangs  that  can  help  them  pursue  their  interests. 
The  formation  of  alliances  could  focus  on  the  employment  of  small  groups  to 
carry  out  activities  on  their  behalf,  or  on  the  union  with  various  syndicates  to 
strengthen  themselves  and  start  a  new  autonomous  criminal  or  terrorist 
organization.  This  cooperation  provides  a  major  opportunity  to  confront  the  legal 
and  security  actions  of  Colombian  authorities. 

There  are  several  reasons  why  groups  would  want  to  engage  in  criminal 
or  terrorist  activities.  First,  territorial  control  largely  determines  criminal  power, 
and  criminal  groups  execute  illegal  actions  in  the  absence  of  institutions  of  the 

9  Marcella  Ribetti,  “Disengagement  and  Beyond  -  A  Case  Study  of  Demobilization  in 
Colombia,”  in  Leaving  Terrorism  Behind  -  Individuai  and  Coiiective  Disengagement,  eds.  Tore 
Bjorgo  and  John  Morgan  (New  York:  Routledge,  2009),  152. 
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state,  which  allows  them  to  control  the  region’s  social,  economic,  and  political 
powers.  Second,  financial  motivations  are  the  center  of  attention,  evolution,  and 
violence  of  criminal  groups.  In  the  Colombian  case,  some  regions  are  still 
affected  by  the  drug  trafficking  while  criminal  activities,  such  as  the  illegal 
exploitation  of  mineral  deposits,  kidnappings,  extortion  and  homicide,  among 
others,  contribute  to  the  financial  strength  of  these  groups.  Third,  state  control 
requires  a  strategic  vision  by  the  criminal  organization;  it  has  the  objective  to  co¬ 
opt  state  institutions,  and  manipulate  and  seek  support  from  the  inhabitants  of 
the  affected  territory,  lo 

C.  RESEARCH  QUESTIONS 

Consequently,  in  order  to  safeguard  Colombia’s  future,  it  is  necessary  to 
assess  the  state’s  capacity  to  face  a  new  generation  of  criminals.  This  thesis 
seeks  to  answer  the  following  questions:  What  are  the  most  relevant 
characteristics  in  the  formation  of  criminal  alliances  by  the  FARC?  What  impact 
do  they  have  on  public  security?  How  can  the  Colombian  authorities  face  this 
potential  problem  in  the  future  and  what  can  be  done  to  prevent  a  spiral  of 
violence?  To  answer  these  questions  this  thesis  explores  three  recent  cases 
where  the  FARC  formed  alliances  with  criminal  organizations.  By  analyzing  these 
cases,  it  seeks  to  identify  the  most  prominent  features  of  those  alliances,  which, 
in  turn,  will  help  Colombian  authorities  implement  strategies  against  criminal 
groups  in  the  post-conflict  framework. 

D.  RESEARCH  SCOPE 

This  thesis  seeks  to  identify  the  most  relevant  characteristics  during  the 
formation  of  criminal  alliances  under  the  modality  of  subcontracting.  The  main 
objective  is  to  analyze  the  settings  of  terrorist  networks  in  charge  of  the  FARC 
and  the  behavior  of  their  members  as  their  networks  evolved  over  time. 


Luis  Jorge  Garay  et  al.,  La  Captura  y  Reconfiguracion  Cooptada  Del  Estado  En  Colombia 
[The  capture  and  co-opted  reconfiguration  of  the  state  in  Colombia]  (Bogota,  Colombia: 
Transparencia  por  Colombia,  2008),  108. 
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The  three  cases  of  FARC-criminal  alliances  analyzed  in  this  research  all 
resulted  in  homicide  and  terrorism,  and  all  had  a  significant  impact  on  Colombian 
society  because  of  the  social  and  political  importance  of  the  victims.  The  first 
case  is  the  homicide  of  Archbishop  Isaias  Duarte  in  Cali,  Colombia,  on  March  16, 
2002.  The  context  of  this  event  was  complex  because  the  government  ended  a 
peace  process  with  the  FARC  on  February  2002.  The  dialogue  between  the 
government  and  the  FARC  began  in  1999  during  Andres  Pastrana’s  presidency, 
which  concluded  in  August  of  that  year. 

The  second  is  the  terrorist  attack  against  the  El  Nogal  club  in  Bogota, 
Colombia,  which  occurred  on  February  7,  2003,  and  left  36  dead  and  164  injured. 
The  El  Nogal  club  is  well-known  because  its  members  are  largely  politicians, 
journalists,  and  businessmen  of  high  society.  This  action  was  considered  one  of 
the  tipping  points  that  allowed  the  government  to  strengthen  security  in  Colombia 
through  the  Democratic  Security  Policy  under  the  presidency  of  Alvaro  Uribe. 

The  third  is  the  terrorist  attack  against  former  minister  of  the  interior 
Fernando  Londoho-Hoyos  in  Bogota,  Colombia.  The  terrorists  activated  an 
improvised  explosive  device  (lED),  known  as  lapa,  in  Londoho’s  vehicle  when  it 
was  traveling  through  a  commercial  area.  The  event  occurred  on  May  16,  2012, 
and  it  left  two  dead  and  51  injured.  That  day.  Congress  was  deciding  the  future  of 
a  law  project  that  gave  legal  life  to  any  peace  process  in  Colombia  with 
insurgents. 

The  major  feature  of  these  three  cases  was  the  FARC’s  decision  to 
subcontract  their  implementation  with  small  criminal  gangs.  The  FARC 
subgroups  linked  to  these  events  have  been  labeled  as  the  most  violent  in  the 
nation.  Nevertheless,  key  elements  of  these  networks  are  less  clear,  including 
personal  relationships  formed  during  the  planning  and  execution  of  the  terrorist 
actions  along  with  evolution  of  these  ties  once  the  gangs  accomplished  the  task. 

The  method  employed  in  this  research  is  social  network  analysis  (SNA). 
With  greater  detail  in  Chapter  II,  this  investigation  explains  the  procedures  and 
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analysis  performed  in  order  to  identify  the  characteristics  of  these  criminal 
alliances.  SNA  is  a  collection  of  theories  and  techniques  that  have  been  fostered 
by  scientific  fields  such  as  anthropology  and  from  theories  such  as  graph  theory. 
Sociologists  use  SNA  to  understand  the  relationships  between  actors,  and  as  a 
tool,  to  identify  trends  in  actor  behavior.  The  next  section,  the  literature  review, 
will  expand  on  SNA  and  delve  deeper  into  important  aspects  of  criminal  and 
terrorist  alliances. 

E.  LITERATURE  REVIEW 

This  section  seeks  to  deepen  knowledge  related  to  two  aspects  of  interest 
related  to  this  research.  It  first  focuses  on  cooperation  between  criminal 
organizations.  It  then  presents  the  importance  of  SNA  when  employed  to  identify 
characteristics  of  criminal  behavior. 

1.  Cooperation  between  Criminal  Organizations 

An  abundance  of  literature  exists  with  regards  to  the  causes  and  effects  of 
cooperation  between  criminal  organizations.  The  German  sociologist  Georg 
Simmel  and  later  Bonnie  Erickson,  examined  the  nature  of  secret  societies  and 
their  features  of  reciprocal  trust  and  the  protection  of  common  interests,  n 
Erickson  examined  societies  under  risk,  that  is,  groups  whose  members  are  in 
danger  of  imprisonment,  injury,  or  death.  She  argued  that  for  these 
organizations,  “the  crucial  motive  is  a  desire  to  maximize  security. ”12  |n  the  case 
of  the  FARC’s  alliances  with  criminal  groups,  one  could  argue  that  the  FARC  is 
seeking  to  maximize  its  security  by  allowing  the  criminal  groups  to  take  most  of 
the  risks. 

Several  studies  have  focused  on  the  methods  by  which  organizations  form 
associations  and  on  the  transformation  of  the  groups  after  an  alliance  is  formed. 

Georg  Simmel,  Conflict  and  the  Web  of  Group  Affiliations  (New  York:  The  Free  Press, 

1955). 

Bonnie  H.  Erickson,  “Secret  Societies  and  Social  Structure,”  Social  Forces  60,  no.  1 
(September  1981):  188-210. 
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For  instance,  Julie  Ayling  draws  on  evolutionary  theory  in  her  analysis  of  how 
gangs  changei^  and  Bill  McCarthy,  Jim  Hagan,  and  Lawrence  Cohen  use  game 
theory  to  show  how  criminals  solve  social  dilemmas.  An  important  focus  of  this 
latter  study  is  the  willingness  of  one  group  to  trust  in  another  to  carry  out 
cooperative  endeavors.  These  alliances  reveal  margins  of  uncertainty  that  lead 
associates  to  face  adversity.  The  authors  suggest  that  “adversity  increases 
people’s  sense  of  desperation  and  networks  provide  access  to  potential 
cooperators,  criminal  capital,  and  information  on  people’s  reputation  for 
trustworthiness. ”14  As  a  result,  network  actors  may  be  willing  to  undertake  risky 
actions.  This  suggests  that  criminal  groups  analyzed  in  this  thesis  may  have 
trusted  the  FARC  far  too  much  and  consequently  underestimated  the  risks  they 
were  taking. 

The  FARC  sought  associations  with  criminal  gangs  they  knew  well  and 
who  were  experts  in  much  needed  skills.  It  required  that  the  criminal  gangs  were 
able  to  fulfill  the  operations  for  which  they  were  subcontracted.  This  commitment 
to  accomplish  terrorist  operations  can  be  associated  with  what  Paolo  Campana 
and  Federico  Varese  propose  regarding  the  establishment  of  credible 
commitments  among  two  or  more  criminal  parties.  They  found  that  “the  likelihood 
of  cooperation  is  higher  among  members  who  are  related,”  as  well  as  “among 
members  who  have  shared  information  about  violent  acts.”i5 

Finally,  social  capital  theory  focuses  on  the  interaction  of  actors  who  seek 
to  maintain  or  gain  different  resources,  such  as  wealth,  power,  and  reputation. i^ 
An  important  assumption  of  this  theory  is  that  the  position  of  an  actor  in  a 

Julie  Ayling,  “Gang  Change  and  Evolutionary  Theory,”  Crime,  Law  &  Social  Change  56, 
no.  1  (August  2011):  1-26. 

"'4  Bill  McCarthy,  John  Hagan,  and  Lawrence  E.  Cohen,  “Uncertainty,  Cooperation,  and 
Crime:  Understanding  the  Decision  to  Co-Offend,”  Social  Forces  77,  no.  1  (September  1998): 

174. 

Paolo  Campana  and  Federico  Varese,  “Cooperation  in  Criminal  Organizations:  Kinship 
and  Violence  as  Credible  Commitments,”  Rationality  and  Society  25,  no.  3  (2013):  271. 

Nan  Lin,  Social  Capital:  A  Theory  of  Social  Structure  and  Action  (New  York:  Cambridge 
University  Press,  2001). 
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network  gives  him  access  to  resources  that  are  embedded  in  social  relations. 
Social  capital  is  often  seen  as  something  positive,  but  terrorist  and  criminal 
organizations  can  draw  on  it  as  well.  As  we  will  see  in  the  case  of  the  FARC, 
when  outsourcing  its  terrorist  operations,  it  sought  to  build  ties  with  criminal 
organizations  that  could  most  efficiently  mobilize  the  necessary  resources  for 
carrying  out  the  desired  attacks. 

The  causes  and  effects  of  cooperation  between  criminal  organizations  are 
diverse  and  many  variables  could  influence,  in  different  ways,  the  formation  of 
ties  between  individuals  and  organizations.  Each  organization’s  context  provides 
a  myriad  of  features  that  need  individual  analysis  to  understand  its  structure  and 
behavior.  For  these  reasons,  one  can  assert  that  the  use  of  SNA  is  the  most 
appropriate  methodology  to  understand  the  context  in  which  the  relationships 
between  individuals  are  established  and  the  evolution  of  these  networks  over 
time. 


2.  Importance  of  Social  Network  Analysis 

Social  network  analysis  “is  a  collection  of  theories  and  methods  that 
assume  that  behavior  of  actors  is  profoundly  affected  by  their  ties  to  others  and 
the  networks  in  which  they  are  embedded. It  can  be  used  to  identify  key 
aspects  of  a  criminal  organization,  such  as  its  overall  topography,  its  central 
actors,  and  so  on.  SNA  methods  have  been  used  in  other  studies  to  examine 
criminal  networks  and  their  behavior  in  various  contexts;  therefore,  its  use  in  this 
context  should  return  insights  for  developing  strategic  options  that  can  be  made 
to  Colombian  security  agencies, 

Criminal  networks  have  complex  structures  and  behavioral  features.  Many 
of  Colombia’s  criminal  networks  have  their  roots  in  the  Medellin  Cartel,  which 


Sean  F.  Everton,  Disrupting  Dark  Networks,  Vol.  34  (New  York:  Cambridge  University 
Press,  2012),  5. 

Andrew  Mark  Fox,  et  al.,  “Examining  Gang  Social  Network  Structure  and  Criminal 
Behavior,”  (Ph.D.  diss.,  Arizona  State  University,  2013). 
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operated  in  Colombia  during  the  1970s  and  1980s.  An  analysis  by  Rebekah 
Dietz  suggests  that  the  network  was  dense  at  its  core  and  centralized  around  a 
few  members  that  made  decisions  for  the  whole  group.  |n  contrast,  the  network 
that  took  over  the  cocaine  trade  after  the  demise  of  the  Medellin  Cartel  appears 
to  have  been  less  centralized  and  often  subcontracted  various  activities  out  to 
other  organizations  in  Mexico,  Venezuela,  and  Ecuador.  This  allowed  them  to  be 
resilient  and  imperceptible  to  judicial  authorities. 20 

The  evolution  of  criminal  organizations  can  be  understood  from  a  network 
analysis  perspective.  H.  Brinton  Milward  and  Jorg  Raab  argue  that  criminal 
networks  are  “dynamic,  not  static.”2i  Members  understand  that  for  their  survival, 
they  must  adapt  to  a  given  context,  which  in  many  cases  means  they  must  rely 
on  others  through  the  formation  of  alliances. 

F.  THESIS  OUTLINE 

This  thesis  contains  six  chapters.  Chapter  I  provides  the  background 
related  to  the  potential  consequences  that  may  arise  at  the  end  of  internal  armed 
conflicts.  It  also  introduces  the  purpose  and  context  of  this  research  along  with  a 
literature  review  of  the  topics  discussed  in  this  thesis.  Chapter  II  offers  a  detailed 
discussion  social  network  analysis  methods  and  metrics  that  this  thesis  uses. 
Chapters  III,  IV,  and  V  analyze,  respectively,  the  three  terrorist  operations 
discussed  earlier  that  the  FARC  subcontracted  out  to  criminal  organizations. 
Finally,  Chapter  VI  offers  conclusions,  a  summary  of  the  research,  and 
implications  for  Colombian  law  enforcement  authorities. 


Rebekah  K.  Dietz,  “Illicit  Networks  Targeting  the  Nexus  between  Terrorists,  Proliferators, 
and  Narcotraffickers”  (master’s  thesis.  Naval  Postgraduate  School),  84-86. 

20  United  Nations  Office  on  Drugs  and  Crime,  “Results  of  a  Pilot  Survey  of  Forty  Selected 
Organized  Criminal  Groups  in  Sixteen  Countries,”  United  Nations, 
https://www.unodc.org/pdf/crime/publications/Pilot_survey.pdf. 

21  H.  Brinton  Millward  and  Jorg  Raab,  “Dark  Networks:  The  Structure,  Operation,  and 
Performance  of  International  Drug,  Terror,  and  Arms  Trafficking  Networks,”  International 
Conference  on  the  Empirical  Study  of  Governance,  Management,  and  Performance  6  (October 
2002),  2004. 
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II.  METHODOLOGY  AND  DATA 


As  noted  in  the  introductory  chapter,  this  thesis  will  draw  on  SNA  as  its 
methodology.  This  chapter  proceeds  as  follows.  First,  it  discusses  the  reasons 
for  choosing  the  three  specific  cases  when  the  FARC  subcontracted  operations 
to  criminal  groups.  Next,  it  details  how  the  data  analyzed  in  this  paper  were 
collected  and  processed.  Finally,  it  discusses  the  SNA  metrics  used  to  analyze 
the  three  networks. 

A.  TERRORISM  AND  HOMICIDE  CASES 

Several  reasons  exist  for  examining  the  three  cases  studies  mentioned  in 
the  previous  chapter.  The  most  relevant  reason  is  that  the  FARC  subcontracted 
those  events  of  terrorism  and  homicide.  The  phenomenon  of  criminal 
subcontracting  is  important  because  the  FARC  typically  plans  and  executes  its 
own  operations.  That  said,  there  are  at  least  three  reasons  why  the  FARC  would 
subcontract  some  of  its  operations  out  to  criminal  groups.  First,  outsourcing 
operations  lowers  the  amount  of  risk  the  FARC  takes  on.  For  practical  and 
efficacious  reasons,  prosecutors  might  prefer  to  locate  and  bring  the  direct 
perpetrators  of  the  events  to  justice  based  on  the  fact  that  they  are  more  likely 
than  the  planners  to  leave  behind  incriminating  evidence.  The  second  reason  is 
that  it  increases  the  physical  security  of  the  FARC  members.  Remote 
commanding  a  terrorist  event  might  contribute  to  preserving  their  capabilities  and 
knowledge  to  deploy  further  operations.  A  third  reason  is  the  reduction  of  costs. 
Members  of  the  terrorist  organization  could  divert  money  for  their  interests,  but 
with  a  subcontracted  group,  the  terrorists  are  bound  to  pay  what  they  have 
agreed. 

These  reasons  are  even  more  compelling  when  one  considers  crime 
dynamics  in  Colombia.  The  FARC’s  violence,  along  with  that  of  other  criminal 
groups,  has  engulfed  the  country,  though  most  of  the  time  the  groups  operate 
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autonomously.  Table  1  summarizes  criminal  activity  from  2003  and  2013.  The 
Ministry  of  Defense  of  Colombia  collected  the  data. 


Table  1 .  Summary  of  crimes  and  their  modalities  between  the  years 

2003  and  2013. 


Crimes 

2003 

2004 

2005 

2006 

2007 

2008 

2009 

2010 

2011 

2012 

2013 

Total 

Homicide 

23,523 

20,210 

18,111 

17,479 

17,198 

16,140 

15,817 

15,459 

16,127 

16,440 

15,419 

191,923 

Injuries 

40,042 

32,535 

30,415 

46,529 

47,957 

66,315 

55,130 

53,181 

62,194 

82,183 

82,940 

599,421 

Kidnappings 

2,123 

1,440 

801 

690 

523 

437 

213 

282 

305 

305 

299 

7,418 

Terrorism 

1,258 

724 

612 

646 

387 

486 

489 

472 

571 

894 

890 

7,429 

Assulton  municipalities 

9 

2 

4 

2 

0 

0 

2 

5 

0 

2 

0 

26 

Aircraft  attacked 

23 

3 

7 

7 

3 

6 

2 

4 

7 

3 

6 

71 

Facilitiesattacked 

38 

17 

14 

7 

3 

0 

6 

9 

20 

23 

30 

167 

Firepower  harassment 

223 

140 

101 

65 

30 

19 

88 

59 

76 

80 

74 

955 

Ambushes 

60 

29 

31 

15 

9 

15 

29 

32 

24 

32 

18 

294 

Armed  contact 

84 

26 

39 

21 

11 

8 

16 

11 

13 

10 

4 

243 

Raid  to  municipalities 

0 

0 

0 

0 

0 

1 

0 

0 

3 

1 

0 

5 

lliegalcheck  points 

234 

102 

71 

49 

19 

3 

18 

11 

9 

16 

23 

555 

Armed  forces  KIA 

597 

590 

717 

594 

457 

373 

468 

487 

484 

377 

361 

5,505 

Armed  forces  wounded 

1.853 

1.949 

1.635 

1.699 

1.801 

1.692 

1.852 

2.031 

2.265 

2.468 

2.609 

21,854 

Criminal  behavior  provides  a  perspective  on  the  myriad  of  criminal 
activities  pursued  during  the  last  decade.  Nevertheless,  all  of  the  offenses  are 
not  attributable  to  the  FARC  even  though  it  was  extensively  involved  in  every 
type  of  crime  committed  in  the  country.  Its  active  participation  in  criminal  events 
is  the  tipping  point  that  leads  this  research  to  emphasize  that  criminal 
subcontracting  by  the  FARC  is  relevant  as  a  subject  of  analysis,  especially  in 
light  of  the  current  peace  negotiations  in  Colombia  between  the  FARC  and  the 
Colombian  government. 

Subcontracting  operations  to  criminal  organizations  will  also  provide 
benefits  to  the  criminal  subcontractor.  First,  the  subcontracted  actor  seeks  a  new 
structural  position  both  during  and  after  the  transaction.  In  the  case  of  a  criminal 
subcontractor,  the  arrangement  provides  recognition  and  respect  among  its 
peers  in  the  criminal  world.  Second,  this  kind  of  relationship  guarantees  to  the 
contracting  party  flexibility  to  execute  tasks,  access  to  new  technology,  and  gain 
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“service  improvement. ”22  |n  the  framework  of  criminal  alliances,  outsourcing 
contributes  to  consolidating  the  FARC’s  security  because  most  of  the  risk  lies 
with  the  subcontracted  criminal  organizations.  Third,  once  the  groups  fulfill  their 
assigned  tasks,  the  participants  will  often  remain  linked  to  each  other.23  That,  at 
least,  is  the  desire  of  the  subcontractors;  they  are  eager  to  form  sustaining 
relationships  with  the  FARC.  This  eagerness,  however,  is  not  always 
reciprocated  by  the  FARC. 

In  order  to  highlight  the  importance  of  these  three  case  studies,  this 
research  draws  from  experts  from  the  Colombian  National  Police.  Analysts  of  the 
law  enforcement  agency  agree  that  these  are  significant  cases  of  criminal 
subcontracting  by  the  FARC.  Likewise,  with  the  help  of  the  NPS  Defense 
Analysis  Department  faculty,  it  was  possible  to  identify  the  relevance  of  the 
subject  and  possibly  its  importance  for  decision  making  in  Colombia. 

B.  COLLECTION  AND  INFORMATION  PROCESSING 

Three  data  sources  were  used  for  this  thesis’s  investigation.  The  first  were 
open  sources  (i.e.,  free  access  to  public):  namely,  the  digital  versions  of 
Colombia’s  largest  media  outlet  El  Tiempo  (founded  in  1911), 24  El  Espectador 
(founded  in  1887), 25  El  Colombiano  (founded  in  191 2), 26  El  Pals  (founded  in 
1950),27  and  Semana  (founded  in  1982). 28 


22  The  terrorist  organization  expected  its  goals  to  be  fulfilled  by  reducing  the  costs  of  their 
investment. 

23  Royston  Morgan,  “The  Context  and  Narrative  of  Outsourcing,”  in  The  Human  Side  of 
Outsourcing:  Psychoiogicai  Theory  and  Management  Practice,  ed.  Stephanie  J.  Morgan  (Malden, 
MA:  John  Wiley  &  Sons,  2009),  106-119. 

24  Ei  Tiempo,  “Noticias  De  Colombia”  [News  from  Colombia],  http://www.eltiempo.com/. 

25  Ei  Espectador,  “Noticias  De  Colombia”  [News  from  Colombia], 
http://www.elespectador.com/noticias. 

26  Ei  Coiombiano,  “Noticias  De  Colombia”  [News  from  Colombia], 
http://www.elcolombiano.com/portada.asp. 

27  Ei  Pais,  “Noticias  De  Colombia”  [News  from  Colombia],  http://www.elpais.com.co/. 

26  Semana,  “Noticias  De  Colombia”  [News  from  Colombia],  http://www.semana.com/. 
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The  second  were  public  judicial  reports,  which  were  located  using  the 
judicial  processes  search  service  of  the  Colombian  judicial  branch.  Its  webpage 
allows  data  scanning  on  individuals  prosecuted  in  the  case  studies. 29  Likewise, 
Internet  queries  returned  judicial  reports  with  data  about  the  members  of  the 
criminal  organizations  and  how  they  planned  and  executed  every  event. 

The  third  type  of  source  is  primary  source  police  information.  Through 
formal  requests  to  the  Colombian  police  intelligence  service,  it  was  possible  to 
obtain  depersonalized  information  about  the  individuals  and  the  groups  involved 
in  the  planning  and  execution  of  the  events.  Although  this  information  is 
interesting  and  its  structure  complies  with  NPS  guidelines  about  human  research 
subjects,  it  is  primarily  used  as  a  lens  to  reduce  the  uncertainty  of  the  information 
gathered  in  this  research. 

Once  the  collection  of  data  was  complete,  the  task  of  information 
processing  began.  Palantir  Technologies,  which  allows  users  to  organize  and 
visualize  relationships  between  people,  locations,  and  events,  was  used  to 
structure  the  data.^o  Structured  data  is  essential  to  build  a  timeline  of  every 
network  and  to  define  the  boundary  of  each  group  with  regard  to  its  associates. 
This  data  organization  determined  the  evolution,  consolidation,  and  termination 
of  each  network. 

The  three  networks  have  characteristics  akin  to  each  other  regarding  their 
data  structure.  These  organizations  are  one-mode  networks  with  undirected  ties. 
The  relationships  between  nodes  are  at  the  individual  level  and  they  represent 
operational  ties.  For  the  purposes  of  this  thesis,  operational  relationships  are 
defined  as  the  ties  between  two  actors  who  belong  to  the  same  organization, 
who  have  participated  in  the  same  events,  or  who  have  an  intimate  relation  that 
affects  in  any  way  the  behavior  of  the  overall  network.  The  Isaias  Duarte  overall 

29  Rama  Judicial  de  Colombia,  “Consulta  De  Procesos”  [Processes’  consultation], 
http://procesos.ramajudicial.gov.co/consultaprocesos/. 

29  Palantir  Technologies,  Nps  Osint,  2014  ed.,  version  3.8.2.8.603030,  2004.  More 
information  about  this  tool  is  available  at  https://wvvw.palantir.com/ 


14 


network  has  21  actors  and  146  ties,  the  El  Nogal  network  has  27  actors  and  156 
ties,  and  the  Fernando  Londoho  network  has  25  actors  and  146  ties. 

The  networks  also  have  similar  characteristics  in  their  formation  of  ties 
over  time.  This  thesis  defines  the  existence  of  relationships  when  the  actors  have 
conducted  operations  together  and  when  they  coincide  in  time  and  space  in  the 
same  organization.  The  length  of  these  relationships  remains  until  an  actor  is 
dead;  similarly,  a  relationship  ends  when  the  actor  is  arrested  and/or  remains  in 
jail. 

C.  DATA  EXPORT  TO  SNA  TOOLS 

From  Palantir,  the  data  were  exported  to  other  analytical  software  tools, 
including  UCINET.31  j\^\q  sNA  program  allows  analysts  to  check  every 
adjacency  matrix  and  clean  them  in  order  to  verify  the  accuracy  of  data  regarding 
nodes  and  their  visualization  in  the  sociograms.  The  matrices  were  transformed 
into  edgelists,  which  were  edited  to  include  temporal  data  (i.e.,  time  stamps)  so 
that  the  time  period  in  which  each  actor  was  present  in  the  network,  as  well  as 
the  length  of  his  relationships  with  other  actors,  is  captured.  This  permitted  the 
creation  of  networks  over  time  using  the  SNA  software  package  Pajek.32 

The  information  was  then  exported  to  the  SNA  tool.  Organizational  Risk 
Analyzer  (ORA), 33  which  includes  the  longitudinal  analysis  tools  needed  for  this 
research.  It  is  important  to  note  that  in  order  to  execute  these  procedures,  the 
research  follows  the  guidelines  suggested  in  the  book  Disrupting  Dark 
/Vefwor/fs.34  Likewise,  the  guidelines  and  other  concepts  were  researched  in  the 


Stephen  P.  Borgatti,  Martin  G.  Everett,  and  L.  C.  Freeman,  UCINET  6  for  Windows, 
Version  6.491  (Harvard,  MA:  Analytic  Technologies,  2002). 

32  Andre]  Mrvarand  Vladimir  Batagelj,  Pajek,  Version  64  3.08,  1996. 

33  Kathleen  M.  Carley,  Organizational  Risk  Analyzer  ORA,  Version  2.3.6  (Pittsburgh,  PA: 
Carnegie  Mellon  University,  2001-2011). 

34  Everton,  Disrupting  Dark  Networks,  451 . 
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books:  Exploratory  Social  Network  Analysis  with  Pajek^^  and  Analyzing  Social 
Networks 


D.  ANALYSIS  OF  DARK  NETWORKS-EXPLORATORY,  DESCRIPTIVE, 

AND  LONGITUDINAL 

1.  Overall  Network  Topography 

The  first  step  an  analyst  should  follow  is  the  exploration  of  the  network’s 
topography.  Following  Sean  F.  Everton,  it  is  possible  to  examine  two  distinct,  yet 
somewhat  related,  topographical  dimensions, 37  which  are  related  to  a  network’s 
level  of  effectiveness  or  performance.  The  first  set  is  the  cosmopolitan-provincial 
dimension.  Density  is  one  of  the  measures  that  characterize  this  dimension.  It 
measures  the  proportion  of  ties  in  the  network.  Unfortunately,  this  measure  is 
inversely  related  to  network  size  because  as  additional  nodes  join  a  network,  the 
number  of  possible  ties  grows  exponentially.  An  alternative  measure  to  density  is 
average  degree,  which  equals  the  mean  number  of  ties  of  each  actor  in  a 
network  and  is  “a  better  measure  of  overall  cohesion  than  density  because  it 
does  not  depend  on  network  size.”38 

Furthermore,  networks  may  have  higher  or  lower  levels  of  clustering, 
which  may  indicate  a  greater  or  lesser  presence  of  strong  or  weak  ties.  The  latter 
reflects  upon  Mark  Granovetter’s  study  on  the  strength  of  weak  ties. 39  Weak  ties, 
according  to  Granovetter,  “are  more  likely  to  form  crucial  bridges  that  tie  together 
densely  knit  clusters  of  people. ’’^o  Strong  ties,  on  the  other  hand,  have  important 

35  Wouter  De  Nooy,  Andre]  Mrvar,  and  Vladimir  Batagelj,  Exploratory  Social  Network 
Analysis  with  Pajek,  Vol.  27  (New  York:  Cambridge  University  Press,  2005),  334. 

36  Stephen  P.  Borgatti,  Martin  G.  Everett,  and  Jeffrey  C.  Johnson,  Analyzing  Social 
Networks  (Thousand  Oaks,  CA:  SAGE  Publications,  2013). 

37  Sean  F.  Everton,  “Network  Topography,  Key  Players,  and  Terrorist  Networks,” 
Connections  32,  no.  1  (June  2012):  12-19. 

33  De  Nooy,  Mrvar  and  Batagelj,  Exploratory  Social  Network  Analysis  with  Pajek,  64. 

39  Mark  S.  Granovetter,  “The  Strength  of  Weak  Ties,”  American  Journal  of  Sociology  78,  no. 
6  (May  1973):  1360-1380. 

"^6  Everton,  “Network  Topography,  Key  Players,  and  Terrorist  Networks,”  13 
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features  to  the  organization.  Studies  about  human  behavior  argue  that  strong  ties 
are  those  relationships  that  give  support  to  people  at  moments  of  difficulty. 
However,  some  studies  explain  the  benefits  of  groups  that  combine  strong  and 
weak  ties. 42 

The  clustering  coefficient  is  one  measure  that  can  be  used  to  estimate  the 
level  of  clustering  in  a  network.  It  captures  “the  extent  to  which  a  network  [has] 
areas  of  high  and  low  density. ”43  The  idea  behind  the  clustering  coefficient  is  that 
“human  social  systems  are  very  clumpy  (thanks  to  factors  such  as  homophily, 
geographical  concentration,  a  tendency  to  develop  relations  with  one’s  relations’ 
relations). ”44  Likewise,  human  systems  are  very  compact  in  the  sense  of  having 
short  paths  linking  everyone  to  everyone  else. 45  To  obtain  this  measure  one 
calculates  the  density  of  each  ego  network.  It  only  uses  ties  between  ego  alters 
and  calculates  the  average  of  these  scores. 46  When  Watts  and  Strogatz 
developed  this  algorithm,  some  SNA  software  incorporated  its  automation  but 
calculated  results  only  for  actors  with  two  or  more  alters,  and  when  the  tools 
determine  the  average,  they  divide  it  by  the  number  of  actors  with  the  clustering 
coefficient.  This  situation  could  lead  to  mistakes  when  dealing  with  sparse 
networks;  for  that  reason,  ORA  generates  an  alternative  measure  in  which  the 
average  is  calculated  by  dividing  the  average  by  the  total  number  of  actors.  For 
this  investigation,  both  calculations  are  used.  With  the  clustering  coefficient,  it  is 


4'!  R.  Stark,  Sociology,  10th  ed.  (Belmont,  CA:  Wadsworth  Publishing  Company,  2007),  37, 
quoted  in  Everton,  “Network  Topography,  Key  Players,  and  Terrorist  Networks,”  14. 

42  References  to  this  perspective  can  be  found  in  Brian  Uzzi,  “The  Sources  and 
Consequences  of  Embeddedness  for  the  Economic  Performance  of  Organizations:  The  Network 
Effect,”  Amer/car?  Sociological  Review  6^ ,  no.  4  (August  1996):  675-677;  Brian  Uzzi  and  Jarrett 
Spiro,  “Collaboration  and  Creativity:  The  Small  World  Problem,”  American  Journal  of  Sociology 

1 1 1 ,  no.  2  (September  2005):  464. 

43  Duncan  J.  Watts  and  Steven  H.  Strogatz,  “Collective  Dynamics  of  ‘Small-World’ 
Networks,”  Nature  393,  no.  6684  (1998):  440-442. 

44  BorgattI  et  al..  Analyzing  Social  Networks,  156. 

45  Stanley  Milgram,  “The  Small  World  Problem,”  Psychology  Today  2,  no.  1  (1967),  60-67. 

46  Everton,  Disrupting  Dark  Networks,  149. 
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possible  to  calculate  what  is  called  the  small-world  quotient.  This  quotient  tells 
“how  connected  and  cohesive  the  relations  in  the  global  network  are,  indicating 
how  productive  or  unproductive  the  distribution  of  creative  material  and 
relationships  are  across  the  global  network. ”47  To  calculate  the  small-world 
quotient,  one  divides  the  clustering  coefficient  by  the  density  of  the  network. 48 

The  second  topographical  dimension,  or  the  hierarchical-heterarchical 
dimension,  is  related  to  the  levels  of  centralization  in  a  network.  One  set  of 
measures,  centralization,  “uses  the  variation  in  actor  centrality  within  the  network 
to  measure  the  level  of  centralization. ”49  This  research  employs  the  following 
measures  of  centrality:  degree,  betweenness,  closeness,  and  eigenvector.  An 
alternative  centralization  measure  is  standard  deviation. It  (SD) — expressed  in 
Equation  2.1 — is  the  square  root  of  the  variance,  which  is  “the  sum  of  the 
squared  differences  between  each  actor’s  centrality  score  (c(«.))and  the 

average  centrality  score^cj.’’^! 


SD  = 


rz:,  c(»,)-cn 


(2.1) 


These  results  seek  to  highlight  the  overall  performance  of  the  network.  Its 
objective  is  to  shed  light  on  the  decision-making  process  concentrated  in  some 
actors  of  the  organization. 

Table  2  summarizes  the  topographical  criteria.  These  parameters  allow  an 
analyst  to  label  networks  in  their  topographical  dimensions  and  use  them  for 
crafting  strategies  and  tactics  against  criminal  or  terrorist  organizations. 


47  Uzzi  and  Spiro,  “Collaboration  and  Creativity:  The  Small  World  Problem,”  464. 

48  Eveiion,  Disrupting  Dark  Networks,  149. 

49  Ibid.,  152. 

59  Lawrence  C.  Hamilton,  Data  Anaiysis  for  Sociai  Scientists:  A  First  Course  in  Appiied 
Statistics  (Belmont,  MA:  Duxbury  Press,  1995),  72-73. 

Everton,  Disrupting  Dark  Networks,  153. 
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Table  2.  Topographical  dimensions  of  networks. 


DIMENSION 

DENSITY 

CLUSTERING  TIES 

CENTRALIZATION 

VARIANCE 

Cosmopolitan 

sparse 

III  +  weak 

low  levels 

ties 

Provincial 

dense 

high  levels  ^ 

Hierarchical 

centralized 

high  levels 

Heterarchical 

decentralized 

low  levels 

2.  Measures  of  Actor  Centrality 

Centrality  measures  are  perhaps  the  most  intuitive  of  all  SNA  metrics. 
According  to  Borgatti,  Everett,  and  Johnson,  “centrality  is  a  property  of  a  node’s 
position  in  a  network;’’52  it  indicates  a  node’s  potential  power  in  terms  of 
opportunities,  influence,  and  the  control  of  the  flow  of  resources  throughout  a 
network. 

The  most  common  centrality  measure  is  degree  centrality,  which  is  the 
count  of  an  actor’s  ties.  It  captures  “an  actor’s  level  of  involvement  or  activity  in 
the  network. ”53  The  value  of  this  centrality  measure  is  its  insight  about  which 
actors  are  more  active  in  the  consolidation  of  ties  through  different  times  and 
levels  of  social  relations  (e.g.,  operational  ties,  friendship  ties  or  business  ties). 

Closely  related  to  degree  centrality  is  eigenvector  centrality.  It  equals  the 
sum  of  an  actor’s  connections  to  other  actors,  weighted  by  their  degree 
centrality. 54  This  algorithm  seeks  to  establish  the  relationship  of  actors  with 
others  who  are  very  active  and  perhaps  influential  in  an  organization.  During  the 
analysis  of  eigenvector  centrality  one  might  consider  significant  differences  in  the 
scale  between  a  node  with  the  highest  value  and  the  following  node.  According 
to  Borgatti  et  al.,  the  value  of  the  first  should  be  “two  or  three  times  as  large  as 


52  Borgatti,  Everett,  and  Johnson,  “Analyzing  Social  Networks,”  164. 

53  Christina  Prell,  Social  Network  Analysis:  History,  Theory  and  Methodology  (Thousand 
Oaks,  CA:  SAGE,  2012),  97. 

54  Phillip  Bonacich,  “Power  and  Centrality:  A  Family  of  Measures,”  American  Journal  of 
Sociology  92,  no.  5  (March  1987),  1172. 
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the  second  largest.  Otherwise,  it  could  be  argued  that  you  really  need  more  than 
one  eigenvector  to  represent  the  position  of  the  node  in  the  network.”55 

Another  common  measure  is  betweenness  centrality.  It  “is  based  upon  the 
frequency  with  which  a  point  falls  between  pairs  of  other  points  on  the  geodesic 
paths  connecting  them. ”56  An  important  matter  with  this  measure  is  that  a  given 
actor  might  choose  another  path  even  if  it  is  longer  and  less  efficient;57  therefore, 
actors  have  limited  potential  for  control  over  whatever  resource  that  passes 
through  them. 

Finally,  closeness  centrality  provides  a  different  approach  to  resource 
control  in  an  organization.  According  to  Alex  Bavelas,  and  later  to  Harold  J. 
Leavitt,  a  central  node  is  one  that  does  not  depend  on  others  to  serve  as 
intermediaries.  The  closest  node  to  other  nodes  has  easier  and  faster  access  to 
resources  that  flow  through  the  network.58  An  alternative  closeness  measure  is 
the  average  of  reciprocal  distance  (ARD).  Unlike  the  standard  measure,  it  is  not 
sensitive  to  disconnected  networks  in  which  it  is  necessary  to  remove  isolates  to 
calculate  a  reliable  score. 59  Fortunately,  all  three  networks  examined  here  are 
connected,  thus  allowing  the  application  of  the  standard  closeness  measure. 

Centrality  measures  provide  analysts  a  vision  of  the  actors  that  are 
potentially  more  active  and  influential  in  the  network.  For  the  analysis  of  the  three 
case  studies  in  this  research,  these  measures  shed  light  on  the  behavior  of 
actors  over  time. 

Borgatti,  Everett,  and  Johnson,  “Analyzing  Social  Networks,”  168-169. 

Linton  C.  Freeman,  “Centrality  in  Social  Networks  Conceptual  Clarification,”  Social 
Networks  1,  no.  3  (1979):  221. 

Linton  C.  Freeman,  Stephen  P.  Borgatti,  and  Douglas  R.  White,  “Centrality  in  Valued 
Graphs:  A  Measure  of  Betweenness  Based  on  Network  Flow,”  Social  Networks  13,  no.  2  (1991): 
141-154. 

Alex  Bavelas,  “Communication  Patterns  in  Task-Oriented  Groups,”  Journal  of  the 
Acoustical  Society  of  America  22,  no.  6  (1950):  725-730;  Harold  J.  Leavitt,  “Some  Effects  of 
Certain  Communication  Patterns  on  Group  Performance,”  The  Journal  of  Abnormal  and  Social 
Psychology  46,  no.  1  (1951):  38. 

Everton,  Disrupting  Dark  Networks,  217. 
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3.  Longitudinal  Analysis 

Networks  are  subject  to  different  contexts  that  make  them  dynamic.  Ian 
McCulloh  argues  that  “in  a  social  network  context,  the  individual  goals  and 
motives  of  a  person,  among  other  factors  may  drive  the  network  to  evolve. 
This  assumption  indicates  that  there  are  endogenous  and  exogenous  factors  that 
contribute  to  change  in  organizations  and  relationships  among  their  members. 

The  possibility  to  identify  changes  quickly  is  an  advantage  for  decision¬ 
making  processes.  In  this  regard,  the  methodological  scope  of  this  research  is 
social  network  change  detection  (SNCD),  which  provides  a  visual  understanding 
of  statistically  significant  changes  in  network  structures  and  guides  analysts  to 
identify  potential  causes  of  such  changes.  McCulloh  and  Kathleen  M.  Carley 
assume  that  this  is  possible  through  the  use  of  a  statistical  process  control  (SPC) 
like  those  employed  by  quality  engineers.  Thus,  monitoring  can  be  exerted  on 
any  topographical  and  centrality  measure.  Analysts  can  use  this  tool  in  ORA.^i 

Here  we  use  the  cumulative  sum  (CUSUM)  control  chart  for  monitoring 
and  detecting  changes  in  the  network.62  Accurate  detection  is  an  advantage 
because  statistical  monitoring  determines  the  scope  of  the  investigation  by 
narrowing  the  timeframe  to  the  moment  before  drastic  changes  occurred. 
CUSUM  employs  a  reference  value  and  control  limit  scores  which  seem  to  be  set 
arbitrarily  and  with  accordance  to  industry  standards.  These  values  identify  false 
alarms  of  significant  changes  of  the  network. ^3 

SNCD  requires  the  configuration  of  timeframes  for  an  accurate  analysis. 
This  research  defines  different  time  periods  to  assess  significant  changes  in  the 


Ian  McCulloh,  “Detecting  Changes  in  a  Dynamic  Social  Network”  (Ph.D.  diss.,  Carnegie 
Mellon  University,  2009). 

Ian  A.  McCulloh  and  Kathleen  M.  Carley,  Social  Network  Change  Detection  (Pittsburgh, 
PA:  Center  for  the  Computational  Analysis  of  Social  and  Organizational  Systems,  2008). 

E.  S.  Page,  “Cumulative  Sum  Charts,”  Technometrics  3,  no.  1  (1961):  1-9. 

Ian  A.  McCulloh,  “Generalized  Cumulative  Sum  Control  Charts”  (master’s  thesis,  Florida 
State  University,  2004),  56. 
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network.  Nevertheless,  every  particular  case  has  a  consistent  timeframe.  In  the 
cases  of  the  killing  of  Archbishop  Isaias  Duarte  and  the  attack  against  El  Nogal 
club,  quarterly  time  periods  are  used.  For  the  failed  attack  against  Fernando 
Londoho,  a  monthly  timeframe  is  used.  Each  case  study  chapter  and  the  related 
appendixes  include  details  of  these  timeframes. 

E.  CHAPTER  SUMMARY 

This  chapter  defined  the  methodology  used  for  this  research.  It  began  by 
outlining  the  justification  for  selecting  the  case  studies,  and  followed  with 
descriptions  of  the  data  and  information  collection  processes.  It  also  explained 
the  use  of  the  technological  tools  that  facilitate  data  manipulation  and  their 
analysis.  Finally,  it  indicated  that  a  particular  methodology  for  this  thesis  is  social 
network  analysis. 
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III.  ISAIAS  DUARTE  CASE  STUDY 


This  chapter  describes  the  alliance  between  the  FARC  and  the  criminal 
organization  that  assassinated  Roman  Catholic  Archbishop,  Isaias  Duarte.  It  is 
divided  into  three  sections.  The  first  details  the  history  and  context  of  the 
homicide.  Several  sources  helped  to  reconstruct  the  facts  of  the  case.  41  time 
periods  were  identified,  each  one  representing  one  quarter  of  a  year.  These  have 
been  compressed  into  nine  critical  moments  and  are  summarized  in  Table  3.6^ 


Table  3.  Isaias  Duarte  network.  Relates  9  critical  moments  with  41 

periods  of  time. 


Critical  Moment  Timeline 

1  1-2 

2  3 

3  4 

4  5-9 

5  10-19 

6  20-28 

7  29-38 

8  39-40 

9  41 


Dates 

January  2002-June  2002 
July  2002-September  2002 
October  2002-December  2002 
January  2003-March  2004 
April  2004-September  2006 
October  2006-December  2008 
January  2009-June  201 1 
July  201 1-December  201 1 
January  2012  and  beyond 


The  second  part  of  the  chapter  is  an  exploratory  analysis  of  the  network’s 
members.  It  focuses  on  the  behavior  of  actors  in  the  overall  network,  particularly 
through  their  centrality  measures  and  their  evolution  over  time.  The  analysis 
includes  measures  of  degree,  eigenvector,  betweenness,  and  closeness 
centrality.®^ 

The  third  part  analyzes  the  network’s  social  structure  and  its 
transformation  overtime,  paying  particular  attention  to  its  provincial-cosmopolitan 

Details  of  the  timeline  are  available  in  Appendix  1  .B. 

UCINET  software  calculated  the  measures  of  centrality.  See  Borgatti,  Everett,  and 
Freeman,  2000,  UCINET  6  for  Windows. 
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and  hierarchical-heterarchical  dimensions.  As  part  of  this  analysis,  it  utilizes 
SNCD  in  order  to  determine  if  and  when  significant  changes  in  the  network’s 
level  of  centralization  occurred.®^ 

A.  BACKGROUND  AND  CONTEXT  OF  THE  HOMICIDE 

On  March  16,  2002,  the  Archbishop  of  Cali,  Colombia,  Isaias  Duarte 
Cancino,  was  assassinated.®^  It  occurred  after  he  concluded  a  Eucharistic 
celebration  in  downtown  Cali.  When  he  was  leaving  the  premises,  he  was  shot 
by  two  individuals  who  also  wounded  another  priest.  Subsequent  investigations 
point  to  the  FARC  as  the  mastermind  of  the  assassination.  According  to  several 
media  reports,  a  prominent  mid-level  commander  of  the  FARC,  identified  in  this 
chapter  as  PC-FCCC,  approved  a  plan  to  subcontract  a  criminal  group  to 
execute  the  operation. 

It  is  likely  that  the  organizational  and  personal  interests  of  PC-FCCC 
served  as  motivations  to  carry  out  the  operation.  The  organizational  interests 
date  back  to  the  time  in  which  Archbishop  Duarte  was  the  head  of  the  Roman 
Catholic  Church  in  the  northern  Colombia  departments  of  Antioquia,  Cordoba, 
and  Uraba.  Because  of  his  ecclesial  role,  he  formed  ties  with  members  of  the 
Autodefensas  Unidas  de  Colombia  (AUC)  (or  United  Self-defense  of  Colombia  in 
English),®®  which  led  the  FARC  to  see  him  as  an  ally  of  the  paramilitaries  who 
oppose  the  FARC.  In  terms  of  personal  motivations,  the  AUC  kidnapped  one  of 
PC-FCCC’s  close  relatives,  so  PC-FCCC  reached  out  to  Archbishop  Duarte  to 
help  get  him  released,  but  Duarte  was  either  unwilling  to  approach  the  AUC  or 
simply  unsuccessful.  Either  way,  PC-FCCC  turned  on  Duarte  and  directly 


Carley,  Organizational  Risk  Analyzer. 

El  Tiempo,  “Sicario  Salio  72  Horas  De  Carcel  Para  Matar  a  Monsenor  Duarte”  [Murderer 
let  out  72  hours  from  jail  to  kill  monsignor  Duarte], 
http://www.eltiempo.com/archivo/documento/MAM-5160703. 

Caracol  Radio,  “Monsenor  Duarte  Cancino  Tuvo  Contactos  Con  Las  AUC  Para  Procesos 
De  Paz:  Iglesia”  [Monsignor  Duarte  Cancino  had  contacts  with  the  AUC  for  peace  processes: 
Church],  http://www.caracol.com.co/noticias/actualidad/monsenor-duarte-cancino-tuvo-contactos- 
con-las-auc-para-procesos-de-paz-iglesia/20100604/nota/1 308528. aspx. 
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threatened  him.®^  Two  hypotheses  have  emerged  about  the  plans  to  kill  Duarte. 
One  contends  that  PC-FCCO  used  two  contacts  from  a  criminal  gang  to  serve  as 
an  intermediary  for  the  assassination.  The  other  argues  that  PC-FCCO  ordered 
another  member  of  his  group,  JFJ-FCCO,  to  subcontract  the  murderers.  This 
thesis  considers  both. 

A  series  of  structural  changes  occurred  in  the  network  following  the 
murder  of  Duarte.  It  appears  that  two  major  factors  caused  these  changes.  The 
first  was  the  state’s  operations  to  arrest  the  suspected  perpetrators  of  the  Duarte 
killing.  The  second,  which  was  related  to  the  first,  was  the  killing  of  those 
suspects  by  unknown  members  of  the  FARC  and  the  criminal  organizations.  It  is 
possible  that  the  FARC  believed  that  the  knowledge  they  had  about  the 
assassination  could  have  endangered  the  FARC  if  they  decided  to  cooperate 
with  authorities. 

Figure  1  depicts  the  overall  network  linked  to  the  Isaias  Duarte 
assassination.  The  red  nodes  represent  the  FARC  members,  while  yellow,  blue, 
and  green  nodes  represent  members  of  various  criminal  gangs.  There  are  three 
important  aspects  of  this  graph  to  consider.  The  first  is  that  the  relationships 
among  its  members  are  communication,  kinship,  and  operational  ties.  Second, 
each  actor’s  name  has  been  anonymized.  This  is  also  true  for  the  case  studies  in 
the  next  two  chapters.  Third,  the  graph  provides  a  general  insight  into  what  the 
structural  position  of  each  actor  was  in  the  network. 


El  Colombiano,  “Piden  Incluir  Testimonio  En  Caso  De  Monsenor  Isaias  Duarte  Cancino” 
[to  Include  testimony  in  case  of  Monsignor  Isaias  Duarte  Cancino], 

http://www.elcolombiano.eom/BancoConocimiento/F/farc_tenian_un_movil_para_matar_a_mons 

enor_duarte_cancino/farc_tenian_un_movil_para_matar_a_monsenor_duarte_cancino.asp. 

Appendix  1.A  provides  a  list  of  open  sources  used  in  this  research.  This  chapter  does  not 
include  all  sources  as  footnotes.  However,  the  sources  have  been  used  to  understand  the  context 
and  the  relationships  between  actors  of  the  network  over  time. 
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Figure  1 .  Overall  network  linked  to  the  murder  of  Isaias  Duarte. 


B.  MEMBERS  OF  THE  TERRORIST  AND  CRIMINAL  NETWORK 

The  network  responsible  for  the  assassination  of  Archbishop  Duarte  is 
relatively  small.  In  its  entirety,  it  consisted  of  21  people.  Overall,  FARC  terrorists 
represent  33.3  percent  of  members  of  the  network,  while  66.7  percent  are 
members  of  different  criminal  organizations.  Of  the  network’s  members,  4.8 
percent  transitioned  from  one  group  to  another  once  they  accomplished  the  initial 
task.  Members  of  the  FARC  belong  to  three  distinct  organizational  levels;  The 
secretariat,  from  which  at  least  four  of  its  members  knew  and  approved  the  plan 
to  kill  Duarte;  two  mid-level  commanders  that  judicial  investigations  found  were 
from  the  Comando  Conjunto  de  Occidente  (or  Western  Joint  Command,  in 
English),  which  operates  in  the  departments  of  Cauca,  Valle,  Nariho,  and  the  city 
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of  Cali;  and  at  least  one  from  the  organization’s  grassroots,  someone  who 
participated  in  the  subcontracting  process  with  the  murderers/’’ 

Criminal  members  of  the  network  belong  to  at  least  two  different  groups. 
Those  who  belong  to  the  first  organization  operated  in  the  sector  known  as  Sol 
de  Oriente  in  Cali.  One  member  of  this  group  was  killed  afterwards  in  jail,  and  the 
second  received  a  sentence  for  the  crime.  It  is  possible  that  two  other  members, 
acting  as  liaisons,  belonged  to  a  different  organization.  Nevertheless,  research 
and  the  data  did  not  provide  that  information.  One  of  the  reasons  is  that  the 
military  forces  carried  out  the  operation  that  led  to  their  arrest  and  not  the 
Colombian  criminal  investigation  agencies. After  their  release,  they  were  killed 
by  unknown  assailants. 

Another  set  of  criminals  joined  the  network  when  the  organization 
achieved  its  primary  objective.  These  were  ten  members  of  the  gang  El 
GrandeJ^  One  of  its  associates,  JFJ-FCCO,  is  an  example  of  someone  who 
transitioned  between  organizations.  He  moved  from  the  FARC  to  the  criminal 
gang. 

Given  the  network’s  dynamic  nature,  it  is  important  to  analyze  the 
behavior  of  actors  over  time.  Centrality  measures  calculated  across  41  time 
periods  contribute  to  determining  each  actor’s  position  in  the  network.  This 
chapter's  introduction  noted  that  nine  critical  moments  compress  the  entire 


Observatorio  de  Procesos  de  Desarme,  Desmovilizacion  y  Reintegracion,  Presencia  De 
Organizaciones  Guerrilleras  y  ‘Bacrim’  En  Territorio  Colombiano  [Presence  of  guerrilla 
organizations  and  ‘Bacrim’  in  the  Colombian  territory]  (Bogota,  Colombia:  Universidad  Nacional 
de  Colombia,  2012  ).  This  report  can  be  accessed  through  the  website: 

http://www.observatorioddr.unal.edu.co/productos_academicos/nuevos/oddr_presenciadeguerrill 

as_ybacrim.pdf 

^2  La  Vanguardia,  “Detienen  Al  Jefe  De  Una  Banda  De  Sicarios  Por  El  Asesinato  Del 
Arzobispo  De  Cali”  [Arrested  boss  of  a  murderer’s  gang  for  the  killing  of  Cali’s  archbishop], 
http://www.lavanguardia.eom/internacional/20020326/51262752148/detienen-al-jefe-de-una- 
banda-de-sicarios-por-el-asesinato-del-arzobispo-de-cali.html#ixzz38KjFFXDm. 

Fiscalia  General  de  la  Nacion,  “Fallo  Condenatorio  Contra  Miembros  De  La  Banda  ‘El 
Grande’”  [Conviction  on  members  of  gang  ‘El  Grande’], 

http://www.fiscalia.gov.co/colombia/noticlas/fallo-condenatorio-contra-miembros-de-la-banda-el- 

grande/. 
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timeline74  Degree  centrality  identifies  which  actors  had  the  greatest  number  of 
ties  during  each  period/^  Only  with  the  exception  of  the  time  of  the  alliance  with 
El  Grande,  the  FARC  members  exert  a  larger  influence  because  of  their 
communications  capabilities  and  decision-making  process.  This  reflects  the 
networks  mesh  shape  type,  where  members  of  El  Grande  are  connected  to  each 
other.  The  mesh  network  contributes  to  the  decision-making  process  making  it 
collegial;  therefore,  there  is  consensus  or  majority  approving  the  execution  of 
crimes  and  terrorist  events. 

Eigenvector  centrality  is  a  relevant  measure  when  one  compares  the 
highest  score  of  an  actor  with  nodes  that  register  half  or  less.^®  For  these  scores, 
members  of  the  FARCs  secretariat  and  the  mid-level  commander  in  charge  of 
the  assassination  have  equivalent  measures,  which  are  double  the  members’ 
scores  with  tactical  roles.  Members  with  the  highest  eigenvector  scores  are  part 
of  the  strategic  level  of  the  organization. 

The  betweenness  centrality  measures  indicate  that  brokerage  processes 
were  dominated  by  the  FARC.^^  In  88.8  percent  of  the  time  periods,  members  of 
the  FARC  were  in  positions  of  brokerage  that  allowed  them  to  control  the  flux  of 
resources  and  influence  decision  making.  The  network’s  evolution  highlights  the 
position  of  actor  PC-FCCO,  who  is  an  important  mid-level  commander  of  the 
FARC  in  western  Colombia.  His  position  as  a  broker  facilitated  the  proposition  of 
his  plan  to  the  FARC’s  secretariat;  similarly,  he  oriented  members  of  his  group  to 
plan  and  execute  the  homicide  with  elements  of  criminal  gangs. 

One  might  interpret  the  position  of  brokerage  as  a  role  of  accountability  by 
which  the  actor  has  to  inform  his  superiors  of  advances  on  terrorism  and  criminal 
plans.  This  position  could  contribute  to  the  security  of  terrorist  group  members  of 


Appendix  1  .C  provides  a  list  of  the  top  ten  actors  with  their  centrality  measures  over  time. 
Freeman,  “Centrality  in  Social  Networks  Conceptual  Clarification,”  219. 

Borgatti,  Everett  and  Johnson,  “Analyzing  Social  Networks,”  168-169. 

Freeman,  “Centrality  in  Social  Networks  Conceptual  Clarification,”  224. 

28 


the  relevant  hierarchical  level.  In  other  words,  PC-FCCO  assumed  the 
responsibility  not  only  for  the  outcome  of  the  operation,  but  also  for  any  negative 
consequences  that  could  be  derived  from  it.  Fortunately  for  him,  the  results  of 
these  operations  contributed  to  PC-FCCO’s  eventual  rise  to  become  a  member 
of  the  FARC’s  secretariat. 

Closeness  centrality  is  another  measure  dominated  by  the  FARC  portion 
of  the  network. The  scores  indicate  that  PC-FCCO  has  the  potential  to  reach 
other  members  within  the  network  in  relatively  quicker  manner  than  others  and 
he  has  access  to  information  and  other  resources  that  keep  the  group  alive.  They 
also  identify  JFJ-FCCO  as  a  potential  key  actor,  who  during  periods  20  to  28 
(October  2006-December  2008)  served  as  a  key  link  of  El  Grande  with  two  of 
the  FARCs  mid-level  commanders:  PC-FCCO  and  JNUV-FCCO.  Although  he 
belonged  to  the  FARC,  he  had  a  deeper  connection  with  a  criminal  gang. 
However,  during  his  transition  from  the  FARC  to  El  Grande  he  contributed  to  the 
terrorist  organizations  interests.  Table  4  shows  the  top  eight  actors’  normalized 
centrality  measures  sorted  by  highest  value. 


Table  4.  Top  eight  actors’  normalized  centrality  measures  in  the 
Isaias  Duarte  murder  overall  network. 


N 

o 

Degree  (norm.) 

Closeness  (norm.) 

Betweenness  (norm.) 

Eigenvector  (norm.) 

1 

JFJ-FCCO  (60) 

JFJ-FCCO  (62.5) 

JFJ-FCCO  (53.4) 

JFJ-FCCO  (44.6) 

2 

El  Grande  1-6  (50) 

JNUV-FCCO  (51.282) 

PC-FCCO  (35.2) 

El  Grande  1-7  (43.7) 

3 

El  Grande  7-10  (45) 

Hitman  1,  El  Grande 
1-7  (50) 

JNUV-FCCO  (28.9) 

El  Grande  8-9  (40.3) 

4 

El  Grande  10  (40) 

El  Grande  8,  9-PC- 
FCCO  (46.5) 

Hitman  1  (17.7) 

El  Grande  10  (36.1) 

5 

PC-FCCO  (35) 

El  Grande  10  (45.455) 

Contact  1  and  2  (2.8) 

Hitman  1  (4.7) 

6 

Secretariat  1-4,  and 
Hitman  1  (20) 

Contact  1-2  (42.5) 

Hitman  2  (0.17) 

JNUV-FCCO  (4.6) 

7 

Contact  1 , 2-Hitman  2 
(15) 

Hitman  2  (38.4) 

El  Grande  1-7  (0.13) 

PC-FCCO  (0.6) 

8 

JNUV-FCCO  (10) 

Secretariat  1-4  (33.8) 

- 

Contact  1  and  2  (0.6) 

78  Ibid.,  224. 
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C.  TOPOGRAPHICAL  DIMENSIONS  OF  THE  OVERALL  NETWORK 

The  overall  network  tends  to  lie  in  the  provincial  dimension  of  network 
topography/^  Average  degree  centrality  is  6.95  and  the  clustering  coefficient  is 
0.89.  This  latter  indicates  that  a  segment  of  the  network  is  highly  dense,  which 
corresponds  to  the  relations  of  actor  JFJ-FCCO,  who  belonged  to  the  FARC  and 
transitioned  to  the  Cali  criminal  gang  afterwards.  Furthermore,  the  network 
seems  to  have  been  well  connected  and  was  able  to  manage  resources 
efficiently  due  to  its  small  world  quotient  that  reached  a  score  of  2.55. 

The  network  also  tends  to  be  heterarchical  in  terms  of  the  hierarchichal- 
heterarchical  dimension  of  network  topography. The  various  centralization 
results  are  relatively  low.  For  instance,  degree  centralization  equals  27.89 
percent,  eigenvector  29.44  percent,  and  closeness  39.34  percent.  Betweenness 
equals  49.03  percent,  suggesting  that  one  actor  was  in  a  position  of  brokerage, 
above  every  other  actor.  This  score  identifies  actor  PC-FCCO  as  the  one  with  the 
highest  centrality  score.  Table  5  summarizes  centralization  scores  of  the  overall 
network. 

Table  5.  Summary  of  centralization  scores  for  the  Isaias  Duarte 

murder  overall  network. 


CENTRALIZATION  MEASURES 

SCORES 

27.89 

Degree  centralization 

percent 

29.44 

Eigenvector  centralization 

percent 

39.34 

Closeness  centralization 

percent 

49.03 

Betweenness  centralization 

percent 

Everton,  “Network  Topography,  Key  Players,  and  Terrorist  Networks,”  13. 
80  Ibid.,  15. 
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standard  deviation  identifies  betweenness  centrality  as  the  measure  with 
the  largest  variation.  Actors  in  the  overall  network  obtained  scores  with  a  range 
between  0.00  and  53.47;  the  normalized  mean  is  6.77,  and  its  standard  deviation 
is  14.32.  These  scores  suggest  that  the  actor  with  the  highest  centrality  is  in  the 
fourth  positive  standard  deviation.  Table  6  summarizes  the  standard  deviation 
scores. 


Table  6.  Summary  of  scores  of  centrality  measures  variability  in  the 

Isaias  Duarte  murder  network. 


STANDARD  DEVIATION  SCORES 

Degree  standard  deviation  3.20 

Eigenvector  standard  deviation  20.73 

Betweenness  standard  deviation  14.32 

Closeness  standard  deviation  9.71 


D.  THE  NETWORK’S  EVOLUTION  OVER  TIME:  A  LONGITUDINAL 

ANALYSIS 

This  network  emerged  when  the  FARC  subcontracted  members  of 
criminal  groups  to  carry  out  the  assassination.  The  ties  suggest  that  the  FARC 
and  the  criminals  had  a  formal,  superior-subordinate  type  of  relationship.  This 
type  of  relationship  could  have  facilitated  communication  from  the  FARC  to  the 
criminal  group.  With  the  objective  of  visualizing  this  change  in  the  networks 
topography,  the  timeline  was  compressed  into  nine  critical  moments,  which  are 
directly  related  to  the  end  of  social  ties  among  the  members.  Figures  2,  3,  4,  and 
5  show  the  centralization  of  the  network  in  relation  to  the  standard  deviation  of 
each  moment.^'' 

During  the  first  time  period,  this  alliance  appears  to  have  maintained  a 
balance  within  the  hierarchical-heterarchical  dimension.  Specifically,  degree 

Appendix  1.D  provides  a  table  with  topographical  measures  and  centralization  of  the 
network  in  critical  moments.  Likewise,  Appendix  1.E  provides  a  visualization  of  the  network’s 
transformation  over  time. 
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centralization  was  37  percent,  eigenvector  centralization  was  52.96  percent, 
betweenness  centralization  was  55.33  percent,  and  closeness  centralization  was 
48.20  percent.  Similarly,  the  network  appears  to  have  maintained  a  balance  on 
the  cosmopolitan-provincial  dimension  of  network  topography.  The  network  had 
an  average  degree  of  3.6  and  a  clustering  coefficient  of  0.58.  These  results 
suggest  that  the  network  had  an  important  mixture  of  strong  and  weak  ties  that 
facilitated  communications  and  the  flow  of  resources  through  the  network. 

Subsequently,  between  March  and  October  2002  (time  periods  1  to  4  on 
the  timeline),  a  series  of  counter-network  operations  led  to  the  detention  of 
members  of  the  network.  During  those  months,  five  members  were  arrested 
because  of  their  involvement  in  the  crime.  Moreover,  a  member  of  the  FARC’s 
secretariat,  who  was  one  of  the  superiors  to  approve  the  plan,  died  from  natural 
causes.  On  the  other  hand,  three  of  the  prosecuted  criminals  were  killed  under 
different  circumstances.  One  was  murdered  in  jail  and  two  were  shot  once  they 
were  released.  It  is  important  to  highlight  that  from  the  five  members,  four  are 
elements  of  criminal  groups  allegedly  responsible  for  the  homicide.  Just  one 
criminal  survives  and  is  currently  serving  a  jail  sentence.  The  fifth  member 
arrested  was  JFJ-FCCO.  He  was  sentenced  in  January  2005,  but  was  released 
in  October  2006  by  a  criminal  court  that  reviewed  the  testimony  against  him.  In 
November  2008  he  was  arrested  again  due  to  his  ties  to  hired  killings.  In  May 
2011,  he  was  killed  by  unknown  murderers  in  a  rural  area  30  kilometers  south  of 
Cali. 

The  death  of  the  perpetrators  and  the  tactical  broker  of  the  FARC  could 
have  a  strategic  impact  that  strengthens  the  physical  and  legal  security  of  the 
FARCs  commanders.  Once  the  organization  accomplished  its  primary  objective  it 
began  to  deteriorate.  Between  time  periods  2  and  19  (March  2002  and 
September  2006),  the  network  lost  five  members  (three  out  of  four  were  killed 
and  one  of  FARCs  high-level  member  was  dead),  which  affected  the  level  of 
centralization,  transforming  the  group  into  a  more  heterarchical  organization, 
while  at  the  same  time  seeing  greater  levels  of  clustering. 
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Between  time  periods  20  and  28  (October  2006  and  December  2008),  the 
network  grew  because  of  the  actions  of  one  actor  who  formed  a  new  alliance  with 
the  criminal  gang  El  Grande.  This  analysis  highlights  JFJ-FCCO  as  an  actor  with 
the  objective  of  being  in  a  position  of  brokerage  between  the  FARC  and  criminal 
organizations  in  Cali.  The  new  criminal  association  impacted  the  levels  of 
centralization,  which  reached  lower  levels  and  higher  variability  in  actors 
centrality.  During  times  periods  29  and  41  a  transformation  can  be  observed 
lasting  until  the  network’s  dissolution.  Flowever,  this  dissolution  is  not  complete 
because  of  two  factors.  First,  the  remaining  members  were  exclusively  from  the 
FARC.  Second,  the  end  of  every  relationship  was  caused  by  operations  of  the 
Colombian  armed  forces,  which  were  promoted  not  only  because  of  the  death  of 
Archbishop  Duarte,  but  because  of  crime  group’s  overall  criminal  activity. 
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Figure  2.  Longitudinal  scores  of  eigenvector  centralization  and  standard 
deviation  (Isaias  Duarte  murder  network). 
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Figure  3.  Longitudinal  scores  of  betweenness  centralization  and 
standard  deviation  (Isaias  Duarte  murder  network). 
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Figure  4.  Longitudinal  scores  of  closeness  centralization  and  standard 
deviation  (Isaias  Duarte  murder  network). 
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Figure  5.  Longitudinal  scores  of  degree  centralization  and  standard 
deviation  (Isaias  Duarte  murder  network). 

Overall,  the  measures  show  a  process  of  decentralization  starting  at  the 
second  critical  moment  between  July  and  September  2002.  This  downward  trend 
reaches  its  lowest  point  at  the  sixth  critical  moment  (October  2006-December 
2008),  which  is  the  period  when  JFJ-FCCO  was  released  from  jail,  formed 
alliances  with  El  Grande,  and  was  then  arrested  due  to  his  ties  with  that  gang. 
One  interesting  feature  is  the  spike  of  degree  centrality  standard  deviation  at  the 
sixth  critical  moment,  which  suggests  that  the  network  became  more  hierarchical 
because  most  of  the  actors  had  the  same  number  of  ties.  In  fact,  62.5  percent  of 
the  actors  were  within  the  first  standard  deviation. 

1.  Social  Network  Change  Detection 

SNCD  can  help  identify  significant  changes  of  centralization  in  the 
network. Figure  7  indicates  that  a  significant  change  coincides  with  point  19  of 
the  timeline.®^  At  that  moment  the  terrorist  group  generated  a  new  alliance  with 

McCulloh  and  Carley,  Social  Network  Change  Detection,  1-20. 

Significant  changes  are  detected  when  measures  cross  a  threshold,  in  this  case  a  default 
score  provided  by  ORA  (i.e.,  0.01/3.5).  For  further  explanation  see  Sean  F.  Everton  and  Dan 
Cunningham,  “Detecting  Significant  Changes  in  Dark  Networks,”  Behavioral  Sciences  of 
Terrorism  and  Political  Aggression  5,  no.  2  (2013):  103;  Everton,  Disrupting  Dark  Networks,  332. 
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the  criminal  organization,  El  Grande,  which  affected  the  networks  centralization 
considerably.  In  a  reciprocal  manner,  one  can  observe  the  increasing  measures 
of  clustering  coefficient  at  time  19.  The  clustering  coefficient  identifies  a  segment 
of  the  highly  connected  network. 


Figure  6.  SNCD  reflects  decreasing  of  betweenness  centralization  at 
time  19  (Isaias  Duarte  murder  network). 


E.  CONSIDERATIONS  FOR  THE  ISAIAS  DUARTE  CASE  STUDY 

This  case  contributes  to  our  understanding  of  the  behavior  of  the  FARC 
with  respect  to  their  subcontracting  with  criminal  organizations.  It  is  important  to 
consider  the  security  context  that  influences  the  FARC’s.  Among  the  essential 
aspects  of  the  Colombian  context,  the  conflict  between  the  FARC  and  the  AUC 
was  an  important  factor  to  foster  a  spiral  of  violence  in  the  country  in  the  early 
2000s. 

The  formation  of  terrorist-criminal  alliances  proved  to  be  an  effective 
measure  that  helped  fulfill  an  objective  that,  in  turn,  would  not  risk  the  physical 
and  legal  security  of  its  members.  It  took  advantage  of  endogenous  factors  to  link 

Appendix  1.F  provides  graphs  that  support  these  statements.  Graphs  were  obtained  using 

ORA. 


36 


temporary  members  of  criminal  gangs.  The  validity  of  this  alliance  is  enforced 
only  by  the  existence  of  ties  between  nodes  of  each  group.  For  this  particular 
case,  the  relations  ended  with  the  death  of  some  of  the  actors  who  could  have 
actively  participated  in  the  fulfillment  of  the  FARC’s  objective.  This  research  does 
not  suggest  that  the  terrorist  organization  is  responsible  for  the  death  of  the 
former  members  of  the  network.  Nevertheless,  their  demise  favored  the 
prevalence  of  nodes  that  have  endured  over  time  and  that  have  reached 
transcendent  roles  in  this  terrorist  group. 

The  centrality  measure  results  highlight  the  positions  of  the  FARCs 
terrorists  as  active  individuals  within  the  network.  Independently  of  their 
stalemate  before  the  assassination  of  the  Archbishop,  their  position  in  the 
network  allowed  them  to  influence  and  maintain  control  of  resources  within  the 
organization. 

The  centralization  results  indicate  that  the  network  tended  to  be 
heterarchical.  However,  there  are  moments  in  which  their  scores  position  the 
group  into  the  middle  point  of  that  dimension  where  they  become  more  flexible. 
Networks  less  centralized  could  reach  two  stages.  One  is  that  the  flux  of 
communication  from  the  FARC  towards  its  allies  remains  at  the  level  of  superior- 
subordinate  type.  The  other  is  the  potential  loss  of  control  of  the  subcontracted 
group,  which  can  be  a  definitive  factor  in  finishing  any  ties  with  criminal  groups  in 
a  shorter  period. 

The  FARC  took  advantage  of  this  alliance  to  fulfill  an  organizational 
objective.  However,  their  actions  could  be  oriented  to  spark  relationships  for 
short  periods  of  time  and  subsequently  end  them  after  they  do  not  need  them 
any  longer.  The  following  chapter  analyzes  another  case  of  criminal  alliance  in 
2003,  promoted  by  one  of  the  most  violent  groups  within  the  FARC. 
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IV.  EL  NOGAL  TERRORIST  ATTACK  CASE  STUDY 


This  chapter  analyzes  the  terrorist  and  criminal  association  that  conducted 
an  attack  on  the  El  Nogal  club.  It  has  a  similar  structure  to  the  previous  one. 
First,  it  describes  the  alliance  between  the  FARC  and  the  criminal  group  that 
carried  out  this  terrorist  attack.  Drawing  on  several  sources  it  builds  a  timeline  of 
38  time  periods  that  help  in  understanding  the  network’s  dynamics.  Every  period 
represents  a  quarter  of  the  year,  and  in  this  case,  it  is  compressed  into  12  critical 
moments.  The  sources  shed  light  on  the  relationships  between  actors  of  the 
network  and  their  evolution  over  time.  Table  7  summarizes  the  relationship 
between  critical  moments  and  particular  time  periods. 


Table  7.  Relation  between  12  critical  moments  and  38  time  periods  of 

the  timeline — El  Nogal  attack  network. 


Critical  moment 

Timeline 

Dates 

1 

1-2 

January  2002-April  2003 

2 

3-4 

May  2003-0ctober  2003 

3 

5 

November  2003-January  2004 

4 

6-7 

February  2004-July  2004 

5 

8-12 

August  2004-0ctober  2005 

6 

13-21 

November  2005-January  2008 

7 

22 

February  2008-April  2008 

8 

23-28 

May  2008-0ctober  2009 

9 

29-32 

November  2009-0ctober  2010 

10 

33-34 

November  2010-April  2011 

11 

35-37 

May  2011-January  2012 

12 

38 

February  2012  and  Beyond 

Next,  it  describes  the  members  of  the  network.  The  analysis  focuses  on 
the  behavior  of  actors  in  the  overall  network  and  their  behavior  during  its 


Appendix  2.A  provides  a  list  of  open  sources  used  in  this  research.  Details  of  the  timeline 
are  available  in  Appendix  2.B. 
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evolution,  using  the  same  four  measures  of  centrality  described  previously: 
degree,  eigenvector,  betweenness,  and  closeness  centrality.^e  Finally,  it 
analyzes  the  network’s  social  structure  and  its  transformation  over  time,  paying 
particular  attention  to  its  provincial-cosmopolitan  and  hierarchical-heterarchical 
dimensions.  As  part  of  this  analysis,  it  utilizes  SNCD  in  order  to  determine  if  and 
when  significant  changes  in  the  network’s  level  of  centralization  occurred. ^7 

A.  BACKGROUND  AND  CONTEXT  OF  THE  ATTACK  ON  EL  NOGAL 

In  February  7,  2003,  the  FARC  executed  a  terrorist  attack  against  the  El 
Nogal  club  in  Bogota,  leaving  36  dead  and  164  injured.  The  FARC’s  Mobile 
Column  Teofilo  Forero  (CMTF)  subcontracted  with  members  of  a  criminal  gang 
from  Bogota,  many  of  whom  were  family  of  CMTF  members.  Among  the 
terrorists  involved  was  JFAZ,  who  had  access  to  the  club  because  of  his  role  as 
squash  instructor.  Judicial  investigations  and  the  media  identified  HDVSAP  as 
the  terrorist  in  charge  of  setting  up  the  operation.  The  motives  that  led  the  FARC 
to  carry  out  this  attack  could  be  related  to  what  some  journalistic  analyses  have 
revealed  about  the  club,  which  the  FARC  saw  as  an  “oligarchy  symbol”  of 
Colombia.  Likewise,  given  the  country’s  security  context  at  the  time,  the  attack 
added  to  a  series  of  terrorist  and  criminal  activities  that  the  FARC  planned  and 
executed  in  major  urban  areas  in  the  country. 

The  FARC  used  a  diverse  set  of  members  to  carry  out  key  logistical  and 
operational  functions  for  the  attack.  It  was  primarily  in  charge  of  logistics  and 
planning;  however,  members  of  the  criminal  gang  were  exclusively  in  charge  of 
its  execution.  According  to  judicial  testimonies  and  the  press,  members  of  the 
FARC  decided  that  during  the  attack,  or  shortly  thereafter,  the  criminals  had  to  be 
killed  in  order  to  unlink  the  terrorist  organization  from  any  legal  responsibility. 
During  the  attack,  two  terrorists  of  the  criminal  gang  died.  A  third  member, 
however,  did  not  enter  to  the  premises  of  the  club  during  the  attack;  he  was 

Borgatti,  Everett,  and  Freeman,  UCINET  6  for  Windows. 

Carley,  Organizational  Risk  Analyzer  ORA. 
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arrested  later  and  now  is  serving  a  38-year  prison  sentence.  The  reconstruction 
of  the  event  allowed  the  authorities  to  identify  the  people  responsible  for  this 
alliance  that  has  been  disrupted  by  the  Colombian  authorities. 

After  the  attack,  the  FARC  tried  to  use  the  network’s  logistic  structure  in 
order  to  execute  other  terrorist  attacks  in  Bogota.  One  of  these  targeted  the 
military  hospital  in  the  northern  zone  of  the  capital  city.  This  allowed  intelligence 
analysts  to  locate  and  arrest  other  members  of  the  network,  which  ultimately 
caused  it  to  disperse  to  different  parts  of  the  country.  This  made  it  more  difficult 
to  arrest  members  of  the  FARC,  but  it  also  probably  decreased  terrorist  attacks 
at  that  time.  Figure  8  depicts  the  overall  network  linked  to  the  El  Nogal  attack. 
Nodes  in  red  are  members  of  the  FARC,  in  blue  are  members  of  its  urban  militia, 
and  yellow  are  members  of  the  criminal  gang.  The  ties  among  actors  are 
organizational  (relationships  among  members  of  the  same  organization), 
operational  (ties  between  actors  participating  in  the  same  events), 
communications,  and  kinship. 


.MTCR  acquainted  to  VJW 


CACR  acquainted  to  VJW 


Figure  7.  Overall  network  linked  to  the  terrorist  attack  on  the  El  Nogal 

club  in  Bogota. 
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The  overall  network  responsible  for  this  attack  is  relatively  small.  Twenty- 
seven  people  played  a  role,  of  which  81 .5  percent  (22)  belonged  to  the  FARC 
and  18.5  percent  (5)  to  the  criminal  gang.  These  percentages  indicate  the 
importance  this  terrorist  operation  had  for  the  FARC.  The  number  of  people 
within  the  FARC  could  indicate  two  things.  First,  members  with  different  expertise 
and  levels  of  command  contributed  to  the  fulfillment  of  the  terrorist  objective. 
Second,  the  diversification  of  members  had  the  purpose  to  compartmentalize  the 
organization,  so  everyone  knew  only  a  part  of  the  general  plan. 

The  most  important  person,  FIDVSAP,  was  a  member  of  the  FARC.  Fie 
presented  a  plan  to  his  immediate  superiors,  MJTC-BS  and  VJSR-BS,  who, 
along  with  six  other  members  of  the  secretariat,  approved  the  operation.  Other 
FARC  members  who  belong  to  the  CMTF  were  responsible  for  the  acquisition, 
transportation,  and  employment  of  explosives  in  a  vehicle.  Other  members  of  the 
group,  what  the  FARC  calls  the  urban  militias,  were  responsible  for  organizing 
the  logistics  and  mobilization  in  the  country’s  capital  city.  The  second  set  of 
actors  is  the  subcontracted  criminal  organization.  They  used  their  access  to  the 
club’s  premises  to  elaborate  a  plan  regarding  timing  and  placement  of  the  lED. 

The  FARC  financed  two  activities  in  order  to  prepare  the  attack.  First,  they 
convinced  JFAZ  and  his  relatives  to  upgrade  a  family  business  with  the  objective 
of  purchasing  an  asset  who  had  the  opportunity  to  become  a  member  of  the  club. 
Second,  they  gave  money  to  JFAZ  in  order  to  buy  a  new  vehicle  to  load  with 
explosives  and  facilitate  their  unsuspected  access  into  El  Nogal’s  premises. 
Some  analysis  suggests  that  these  financing  operations  cost  nearly  80  million 
Colombian  pesos. The  FARC  financed  other  activities,  such  as  the  means  of 
transportation,  the  acquisition,  mobilization,  and  adaptation  of  explosives,  the 


According  to  Colombian  financing  services  the  exchange  rate  for  the  time  was  nearly 
$2,963.28  pesos  per  dollar.  These  operations  had  an  approximate  cost  of  $26,997.1 1  U.S. 
dollars.  This  information  was  drawn  from  Banco  de  la  Republica,  “Serie  Historica  -  Tasa  De 
Cambio  Representativa  Del  Mercado  (TRM)”  [Historical  series  -  representative  market  exchange 
rate],  http://www.banrep.gov.co/es/trm. 
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rental  of  the  workshop  and  other  actions  involving  the  subcontracted  criminal 
gang. 

A  CMTF  member  had  supervised  and  coordinated  the  attack.  This  person, 
identified  as  VJVV,  concentrated  the  actors’  capacities  around  the  criminal 
organization  and  the  workshop.  He  did  not  have  an  exclusive  contact  with 
HDVSAP  to  whom  he  must  render  accounts  for  the  plan’s  development,  which 
suggests  that  many  members  were  commissioned  directly  by  HDVSAP; 
therefore,  communication  channels  were  not  empowered  to  just  one  actor  in 
Bogota.  One  might  assume  that  HDVSAP  preferred  to  have  open  possibilities  to 
get  in  touch  with  members  of  the  network.  Openness  gave  him  the  capacity  to 
intervene  on  decisions  about  critical  matters  in  order  to  fulfill  the  objectives  of  the 
attack.  The  influence  of  FARC  members  in  the  network  is  clear  when  one 
examines  their  centrality  measures. 

B.  MEMBERS  OF  THE  TERRORIST  AND  CRIMINAL  NETWORK 

The  development  of  individual  activities,  as  well  as  the  decision  to  murder 
members  of  the  criminal  organization,  appears  to  have  influenced  the  relative 
importance  of  FARC  members  within  the  network.89  The  centrality  results 
demonstrate  this.  During  the  first  moments  of  this  alliance,  HDVSAP  and  HABAP 
had  the  largest  amount  of  connections — the  former  because  of  his  direct 
communication  with  the  FARC’s  secretariat;  the  latter,  because  of  his  kinship  ties 
with  members  of  the  criminal  group.  With  the  elimination  of  the  criminal  group, 
HDVSAP  and  VJVV  lost  many  of  their  network  ties.  The  decision  to  kill  the 
criminals  could  have  generated  fear  among  the  remaining  actors,  and  this  could 
have  led  to  the  gradual  arrests  of  the  remaining  network  members.  Table  8 
presents  the  overall  network  top  eight  actors  ranked  by  normalized  centrality 
scores. 


A  detailed  report  of  centrality  measures  of  the  top  ten  actors  over  time  is  available  in 
Appendix  2.C. 
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Table  8.  Overall  centrality  measures  in  the  El  Nogal  attack  network. 


No 

Degree  (norm.) 

Closeness  (norm.) 

Betweenness  (norm.) 

Eigenvector  (norm.) 

1 

HDVSAP  (38.4) 

Hdvsap  (61.9) 

Hdvsap  (54.6) 

Mjtr-BS  and  Vjsr-BS 
(50.8) 

2 

Mjtr-BS,  Jfaz,  Vjsr-BS, 
Habap,  and  Wdr  (30.7) 

Habap  (52) 

Vjvv  (22.8) 

Secretariat  1-6  (48.3) 

3 

Secretariat  1-6,  and 
OAB  (26.9) 

Jvv  (50) 

Mjtr-bS  and  Vjsr-BS 
(17.5) 

Hdvsap  (20.70 

4 

VJVV  (23.07) 

Wdr  (49.05) 

Habap  (15.8) 

Wdr  (7.5) 

5 

Ajalm,  Apan,  Fgrg,  and 
Fab  (19.2) 

Mjtr-BS  and  Jjsr-BS 
(48.14) 

Wdr  (10.4) 

Habap  (7.2) 

6 

Egnmm,  Gecd,  Dappa, 
Jgmj,  And  Lvvl  (15.3) 

Ajalm  (45.6) 

Apan  (4.15) 

Ajalm  (6.2) 

7 

Cacr ,  Mtcr,  and  Rcr 
(11.5) 

Egnmm  and  Fgrg 
(44.06) 

Jfaz  (3.9) 

Egnmm  (5.8) 

8 

AMB  (7.6) 

Jfaz  (42.6) 

Fgrg  (3.7) 

Fgrg  (5.3) 

In  terms  of  eigenvector  centrality,  it  is  important  to  highlight  the 
relationship  between  HDVSAP  and  the  FARC’s  secretariat.  Among  the  highest 
members  within  the  formal  hierarchy,  their  eigenvector  scores  are  the  same.  As 
noted  previously,  this  measure  is  significant  when  one  compares  the  highest 
score  with  the  second  higher,  if  the  latter  is  half  or  less  than  the  first  actor. In 
the  case  of  HDVSAP,  he  represents  an  important  finding  for  this  investigation.  He 
has  conducted  large  terrorist  events  that  damaged  different  sectors  of  the 
Colombian  society,9i  which  have  benefited  the  FARC  over  a  long  period. 
However,  he  has  not  risen  to  upper  echelons  of  the  organization  and  has 
remained  a  tactical  operator  within  it.  This  analysis  cannot  identify  the  real 
causes  that  prevent  him  from  becoming  a  member  of  the  secretariat,  but  one 
could  argue  that  his  abilities  only  satisfy  the  operational  requirements  of  the 
FARC  and  do  not  reflect  a  strong  strategic  capability.  For  example,  his  use  of 


Borgatti,  Everett,  and  Johnson,  “Analyzing  Social  Networks,”  168-169. 

O'!  El  Espectador,  ‘“El  Paisa’,  Un  Objetivo  Clave”  [‘El  Paisa’,  a  Key  Target], 
http://www.elespectador.com/noticias/judicial/el-paisa-un-objetivo-clave-articulo-421782. 
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violence  might  be  seen  as  a  detriment  to  the  long-term  strategic  objectives  of  the 
FARC  in  the  political  arena. 

With  respect  to  betweenness  centrality,  one  can  observe  actors’  dynamics 
in  two  broad  phases. 92  The  first  identifies  FARC  members  FIDVSAP,  VJVV,  and 
HABAP  as  actors  in  position  of  brokerage.  HDVSAP  controls  information  flux 
between  the  FARC’s  secretariat  and  the  rest  of  the  organization.  VJVV 
coordinates  the  attacks  planned  to  strike  Bogota,  and  FIABAP  is  a  FARC 
member  with  kinship  ties  with  the  criminal  group.  The  position  of  brokerage 
dissipates  from  the  moment  of  the  terrorist  attack,  and  changes  completely  with 
the  arrest  of  VJW  in  the  year  2004  and  FIABAP  in  201 1 .  The  second  phase 
begins  with  the  security  agencies’  actions  against  the  network  and  later  with  the 
death  in  action  of  VJSR-BS.  These  events  indicate  that  intermediation  power 
returns  to  a  superior  level  of  the  hierarchy,  which  is  the  level  that  decides  what 
actions  HDVSAP  can  perform  with  his  terrorist  subgroup. 

Closeness  centrality  can  help  to  identify  the  extent  to  which  FARC 
secretariat  members  exerted  control  over  the  network. 93  HDVSAP’s  superiors, 
MJTR-BS  and  VJSR-BS,  are  in  a  position  that  allows  them  to  access  resources 
quickly.  One  could  argue  that,  although  the  attack’s  operational  control  was  in  the 
mid-level  commander’s  hands,  the  secretariat  had  resources  to  intervene  at  any 
time.  Similarly,  the  secretariat  could  have  asked  anyone  in  the  network  to  render 
accounts.  Nevertheless,  this  argument  could  fall  short  considering  that  this 
analysis  does  not  consider  actors  who  are  part  of  the  FARC  but  not  a  part  of  this 
operation.  These  actors  could  influence  the  access  to  resources,  particularly 
information  going  to  the  hierarchical  level. 


92  Freeman,  “Centrality  in  Social  Networks  Conceptual  Clarification,”  224. 

93  Ibid.,  224. 
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C.  TOPOGRAPHICAL  DIMENSIONS  OF  THE  OVERALL  NETWORK 

The  overall  network  tends  to  lie  in  the  cosmopolitan  dimension  in  that  it  is 
relatively  sparse. 94  The  overall  organization  had  a  density  of  0.22,  and  an 
average  degree  of  5.78.  When  one  compares  these  metrics  with  the  Isaias 
Duarte’s  network  (i.e.,  provincial  dimension),  one  finds  that  its  average  degree 
was  6.95  and  the  clustering  coefficient  reached  0.89,  suggesting  higher 
connectivity  in  the  Duarte  example.  On  the  other  hand,  El  Nogal  network  was  not 
highly  connected  and,  in  order  to  be  effective,  it  had  to  rely  on  weak  ties  to  bridge 
clustered  segments.  The  existence  of  weak  ties  from  the  general  structure  of  the 
organization  helps  in  identifying  four  subgroups:  the  FARC’s  secretariat,  mid¬ 
level  commanders,  militias,  and  the  criminal  organization  members.  Actors  from 
these  segments  had  a  power  of  brokerage  that  kept  the  network  connected. 

The  network  appears  to  lie  in  a  middle  point  between  the  heterarchical 
and  hierarchical  dimension. 95  One  can  see  that  the  centralization  measures  are 
relatively  low,  except  for  betweenness  centralization,  which  reaches  50.72 
percent.  In  this  sense,  HDVSAP  and  MTSR-BS  have  the  highest  scores  of 
centrality.  This  measure  suggests  that  these  actors  had  a  brokerage  potential  in 
the  network.  This  condition  is  related  to  the  exit  of  ten  actors  during  the  first  five 
periods  on  the  timeline,  which  correspond  to  the  following  15  months  after  the 
attack.  Table  9  summarizes  centralization  scores  of  the  overall  network. 

Table  9.  Summary  of  the  overall  El  Nogal  attack  network’s 

centralization. 

CENTRALIZATION  MEASURES  SCORES 

Degree  centralization  17.54  percent 

Eigenvector  centralization  42.45  percent 

Closeness  centralization  38.02  percent 

Betweenness  centralization  50.72  percent 


94  Everton,  “Network  Topography,  Key  Players,  and  Terrorist  Networks,”  13. 

95  Ibid.,  15. 
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An  alternative  centralization  measure  is  the  variance  (standard  deviation) 
in  actors’  centrality.  Particularly  the  attention  of  this  analysis  focuses  on 
betweenness  centrality.  In  the  overall  network  actors  had  scores  in  a  range  of 
0.00  to  54.65,  with  a  mean  of  5.81  and  a  standard  deviation  of  11.59.  These 
figures  suggest  that  the  margin  of  variance  was  large,  and  actors  with  the  largest 
scores  had  a  peculiar  power  above  the  rest.  These  results  compared  to  the 
Isaias  Duarte  case  study  indicate  that  the  Londoho  attack  network  had  low  levels 
of  variation,  suggesting  that  the  network  is  more  heterarchical  than  the  network  in 
the  Isaias  Duarte  case.  Table  10  summarizes  the  Londoho  attack  network 
standard  deviation  results. 


Table  10.  Summary  of  alternative  measures  regarding  the  network’s 


standard  deviation. 

STANDARD  DEVIATION  SCORES 

Degree  standard  deviation  2.01 

Eigenvector  standard  deviation  (norm.)  20.9 

Betweenness  standard  deviation  (norm.)  1 1 .59 

Closeness  standard  deviation  6.49 


D.  THE  NETWORK’S  EVOLUTION  OVER  TIME:  A  LONGITUDINAL 
ANALYSIS 

The  network  began  its  activities  with  high-levels  of  betweenness 

centralization.  One  can  highlight  HDVSAP’s  structural  position  because,  at  least 

at  the  earliest  phase  of  operations,  he  controlled  the  flow  of  resources. 

Communications  between  his  superiors  and  subordinates  contributed  to  his 

capacity  for  decision  making  and  for  transmitting  orders  efficiently.  Similarly,  he 

had  the  potential  to  interact  with  other  members  who  had  specific  tasks.  During 

the  times  2  through  5,  which  correspond  to  the  following  months  after  the  attack 

(February  2003  until  January  2004),  the  organization  betweenness  centralization 

increased  even  more.  One  could  interpret  this  as  a  result  of  HDVSAP’s  activities 

to  seek  further  control  over  terrorist  plans.  One  could  also  argue  that  when  the 
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FARC  pretended  to  execute  other  terrorist  events  with  the  same  resources,  this 
decision  led  to  the  failure  of  some  of  the  other  ongoing  projects. 

Between  the  time  periods  6  and  32  (February  2004  until  October  2010), 
several  important  changes  occurred  in  the  network.  This  was  seven  years  after 
the  attack  (i.e.,  February  2003)  and  may  indicate  that  when  it  accomplished  its 
primary  objective,  its  actors’  priorities  and  objectives  changed.  One  might  argue 
that  exogenous  factors  influenced  the  network,  particularly  from  the  action  of  the 
state,  were  only  relevant  during  the  first  year  after  the  attack.  Subsequent 
changes  are  consistent  with  the  Colombian  armed  conflict  dynamic.  The  state’s 
actions  were  oriented  to  punish  the  organization  responsible  for  the  El  Nogal 
attack,  but  their  arrests  or  deaths  were  more  related  to  other  criminal  and  terrorist 
events  performed  during  their  trajectories  within  the  FARC. 

Two  characteristics  are  observable  during  the  network’s  transformation 
from  February  2004  and  October  2010.  First,  the  relationships  between  actors 
were  more  homogenous,  which  suggests  there  was  not  an  actor  who  had 
potential  power  of  brokerage  to  influence  the  decision-making  process  or  to 
manipulate  resources.  Second,  the  increase  in  closeness  centralization  may 
indicate  that  an  actor  or  small  set  of  actors  had  a  larger  capacity  to  access 
resources  in  the  network  reciprocally.  However,  closeness  centralization  reached 
its  highest  point  (48.16  percent)  between  periods  13  to  21,  which  corresponds  to 
the  time  authorities  arrested  two  terrorists  (November  2005  to  January  2008). 
One  belonged  to  the  criminal  organization  that  did  not  enter  the  club,  and  the 
other,  a  FARC  member  arrested  in  the  Colombia’s  southern  border,  was 
responsible  for  the  acquisition  of  explosives. 

Between  time  periods  33  and  38  (November  2010  and  beyond  January 
2012),  the  network  shrank  to  just  include  FARC  members.  Without  the 
participation  of  members  of  other  organizations  and  with  the  exit  of  FARC 
members  of  the  tactical  level,  the  network  remained  integrated  by  radical 
members  and  the  highest  hierarchical  level.  Reduction  of  ties  between  actors 

influences  degree  centralization,  which  is  not  necessarily  a  logical  consequence 
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of  the  reduction,  but  it  might  be  related  to  actors  belonging  to  the  same  cluster. 
Figures  8  to  11  identify  the  variation  of  centralization  regarding  the  standard 
deviation  of  each  critical  moment.96 
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Figure  8.  Longitudinal  scores  of  degree  centralization  and  its  standard 
deviation  in  the  El  Nogal  attack  network. 


Figure  9.  Longitudinal  scores  of  eigenvector  centralization  and  its 

standard  deviation. 


Appendix  1  .D  provides  a  chart  with  topographical  measures  and  centralization  during  the 
critical  moments  of  the  alliance.  Appendix  1.E  provides  a  visualization  of  the  network’s 
transformation  over  time. 
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Figure  10.  Longitudinal  scores  of  betweenness  centralization  and  its 
standard  deviation  in  the  El  Nogal  attack  network. 


Figure  1 1 .  Longitudinal  scores  of  closeness  centralization  and  its 
standard  deviation  in  the  El  Nogal  attack  network. 
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1. 


Social  Network  Change  Detection 


This  section  now  turns  to  SNCD  to  identify  significant  changes  in  degree, 
betweenness,  closeness,  and  eigenventor  centralization. 97  The  first  three 
measures  indicate  that  a  significant  event  occurred  at  time  7  (Figures  12  and  13). 
These  are  visible  by  a  reduction  in  betweenness  and  closeness  centralization 
and  an  increase  in  degree  centralization.  It  is  possible  that  the  death  of  one  of 
the  FARC’s  secretariat  members  could  have  affected  the  decision-making 
context  of  the  organization,  as  well  as  initiatives  formulation  in  the  tactical  and 
strategic  ambiences  importantly.  The  FARC  had  not  registered  the  death  of  any 
one  of  its  warlords  in  a  recent  time.  The  last  event  was  the  death  of  one  of  the 
FARC’s  cofounders,  known  as  Luis  Morantes,  alias  Jacobo  Arenas,  in  August  10, 
1990.98 


Figure  12.  SNCD  reflects  increasing  in  degree  centralization  at  time 

seven  (El  Nogal  attack  network). 


McCulloh  and  Carley,  Social  Network  Change  Detection,  1-20. 

Insightcrime,  “Las  FARC  1964-2002:  De  Una  Rebelion  Desordenada  a  Una  Maquina 
Militar”  [The  FARC  1964-2002:  From  a  messed  up  rebellion  to  a  military  machine], 
http://es.insightcrime.org/investigaciones/farc-de-rebelion-desordenada-a-maquina-militar. 
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Figure  13.  SNCD  identifies  decreasing  in  betweenness  and  closeness 
centralization  at  time  seven  (El  Nogal  attack  network). 


Eigenvector  centralization  reflects  significant  changes  in  the  network  as 
well.  It  increases  during  time  22  and  decreases  in  time  28  (Figure  14).  The 
increment  figures  grew  from  37.76  to  50.65  percent.  This  variation  could  have  its 
origin  in  the  death  from  natural  causes  of  the  top  leader  of  the  organization 
known  as  Pedro  Marin,  alias  Tirofijo,  in  March  2008.  Eigenvector’s  decrease 
went  to  30.58  percent  in  the  time  corresponding  to  August  2009  when  authorities 
arrested  FARC  members  requested  in  extradition  by  the  United  States  justice. 


Eigenvector  network  centralization  -  Change  Detection 


Decrease  Increase 


Figure  14.  SNCD  reflects  increasing  in  eigenvector  centralization  at  time 
22  and  decreasing  at  time  28  (El  Nogal  attack  network). 
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E.  CONSIDERATIONS  FOR  THE  EL  NOGAL  CASE  STUDY 

This  analysis  identifies  probable  causes  that  motivated  the  terrorist  attack 
against  the  El  Nogal  club.  The  FARC  had  a  political  motive  to  punish  an 
“oligarchy  symbol”  of  Colombia.  In  fact,  this  club  is  well-known  because  its 
members  are  part  of  the  Colombian  haute  society  who  frequently  visits  these 
facilities.  However,  with  regards  to  the  context  of  this  attack,  one  can  argue  that 
the  FARC  had  prepared  a  series  of  terrorist  events  against  a  myriad  of  targets. 
Among  the  objectives  were  the  military  hospital,  restaurants,  and  pubs  in  the 
northern  zone  of  Bogota. ^9 

An  interesting  feature  regarding  this  attack  is  the  strategy  to  detach  the 
FARC  from  any  legal  responsibility.  Judicial  investigations  and  the  media 
revealed  that  the  FARC  decided  to  kill  the  criminals  involved  in  this  terrorist 
operation.  During  the  terrorist  attack,  two  members  died,  although  the  third 
member  did  not  enter  the  premises  and  was  arrested  later  and  received  a  judicial 
sentence  to  serve  38  years  in  prison. 

Once  the  group  achieved  its  primary  objective,  the  FARC  might  have 
thought  to  continue  with  their  terrorist  plans  through  their  same  members.  This 
decision  could  be  decisive  in  reducing  their  organizational  capabilities, 
considering  that  authorities  would  have  information  about  people  and  places  that 
resulted  in  their  arrests.  One  could  suggest  that  when  terrorist  organizations 
pretend  to  perform  extensive  operations,  a  factor  of  success  relies  on  the 
renewal  of  logistic  and  human  resources.  Nevertheless,  there  are  two  reasons  for 
this  network’s  success.  First,  the  number  of  FARC  members  participating  in 
various  activities  suggests  that  it  had  more  direct  control  over  the  network’s 
resources.  Second,  HDVSAP  was  able  to  control  the  network  from  a  distance. 
He  effectively  communicated  with  the  group  by  keeping  his  channels  of 


El  Espectador,  “Alias  ‘El  Paisa’  Presunto  Responsable  Del  Atentado  En  Zona  Rosa  De 
Bogota”  [Alias  ‘El  Paisa’  responsible  of  the  attack  on  Bogota’s  rose  zone], 
http://www.elespectador.com/noticias/judicial/articulo-alias-el-paisa-presunto-responsable-del- 
atentado-zona-rosa-de-bogota. 
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communication  open  and  through  a  variety  of  human  sources.  A  segment  of  the 
network  with  a  relevant  role  is  the  FARC’s  secretariat.  The  members  of  this 
hierarchical  level  are  highly  connected,  and  their  ties  contribute  to  the  formation 
of  a  mesh  type  network,  which  allows  it  to  make  decisions  by  seeking  consensus 
or  unanimity.  This  behavior  suggests  that  the  organization  at  this  level  of 
command  is  very  dense  but  highly  sensitive  to  anything  that  happens  to  one  of  its 
members.  Besides  this,  FARC  members  reside  in  different  parts  of  the  country, 
as  well  as  outside  of  the  country,  which  makes  it  highly  resistant  to  the  state 
actions.  Moreover,  the  hierarchical  structure  allows  it  to  access  resources 
quickly,  especially  information  moving  through  its  structure. 

The  hierarchical  level  of  the  terrorist  group  is  conscious  of  the  violence 
deployed  in  its  operations.  One  could  argue  that  these  decisions  have  served  the 
organizational  objectives.  However,  as  rational  actors,  they  must  acknowledge 
the  consequences  derived  from  this  type  of  action,  like  prosecutions  and  political 
detriment  in  their  intentions  for  state  control. loo  The  level  of  violence  could  be  a 
major  factor  why  FARC  members,  like  HDVSAP,  do  not  belong  to  the  upper  level 
of  command.  The  FARC  might  assess  that  his  potential  upgrade  could  bring  forth 
adverse  effects  on  their  intentions  as  an  armed  movement  particularly  during  the 
phase  of  political  transitioning  as  an  option  to  end  the  conflict  in  Colombia,  loi 

The  following  chapter  shows  the  development  of  the  FARC’s  vision 
regarding  criminal  associations.  The  next  case  study  occurs  nine  years  after  the 
El  Nogal  attack.  It  attempted  to  murder  a  former  Minister  of  Interior  in  Bogota. 
This  event  provides  important  insights  about  the  transformation  of  the  FARC 
concerning  subcontracting  criminal  organizations  to  carry  out  relevant  actions  on 
their  behalf. 


Gordon  H.  McCormick  and  Frank  Giordano,  “Things  Come  Together:  Symbolic  Violence 
and  Guerrilla  Mobilization,”  Third  World  Quarterly  28,  no.  2  (March  2007):  316. 

Gordon  H.  McCormick,  Steven  B.  Horton,  and  Lauren  A.  Harrison,  “Things  Fall  Apart: 
The  Endgame  Dynamics  of  Internal  Wars,”  Third  World  Quarterly  28,  no.  2  (March  2007):  323. 
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V.  FERNANDO  LONDONO  CASE  STUDY 


This  chapter  analyzes  the  terrorist  attack  against  the  former  Minister  of  the 
Interior,  Fernando  Londoho,  in  May  2012.  The  chapter  develops  its  content  in 
three  sections.  First,  it  provides  a  detailed  account  of  the  events  that  occurred 
over  a  24-month  period,  which  are  then  condensed  into  seven  critical  periods. 
Table  11  summarizes  the  critical  moments  and  particular  periods  on  the 

timeline.  102 


Table  1 1 .  Relationship  between  seven  critical  moments  with  every 

period  on  the  timeline. 


Critical  moment 

Timeline 

Dates 

1 

1-2 

April  2012-IVIay  2012 

2 

3-5 

June  2012-August  2012 

3 

6-15 

September  2012-June  2013 

4 

16-17 

July  2013-August  2013 

5 

18-21 

September  2013-December  2013 

6 

22-23 

January  2014-February  2014 

7 

24 

March  2014  and  beyond 

The  second  section,  as  in  the  previous  chapters,  is  an  exploratory  analysis 
of  the  network’s  members.  It  focuses  on  the  behavior  of  actors  in  the  overall 
network,  particularly  through  their  centrality  measures  and  along  their  evolution 
over  time.  The  analysis  includes  measures  of  degree,  eigenvector,  betweenness, 
and  closeness  centrality. 

The  third  section  describes  the  network’s  topography  and  its 
transformation  over  time.  It  utilizes  ORA’s  change  detection  tool  to  identify  drastic 
and  statistically  significant  transformations  in  the  network’s  level  of  centralization. 


"1 112  Details  of  the  timeline  are  available  in  Appendix  3.B. 
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A.  BACKGROUND  AND  CONTEXT  OF  THE  TERRORIST  ATTACK  TO 

MURDER  FERNANDO  LONDONO 

Fernando  Londono  Hoyos  was  Minister  of  the  Interior  in  Colombia.  He 
served  under  the  government  of  President  Alvaro  Uribe  Velez  during  his  first 
presidential  period.  Once  he  left  office,  he  directed  a  radio  program  at 
Colmundo  station  in  Bogota.  According  to  the  Protection  Unit  of  the  Ministry  of 
the  Interior,  Londono  received  threats  from  the  FARC,  which  were  confirmed  with 
seized  computer  files  belonging  to  the  terrorist  organization. Some  studies 
have  sought  to  discern  the  reasons  that  led  the  FARC  to  attempt  to  murder 
Londono.  Some  have  pointed  to  the  role  he  played  in  improving  the  country’s 
security  conditions  and  argued  that  the  attack  attempted  to  test  the  government’s 
capacity  to  provide  security  at  all  its  levels,  ranging  from  the  average  citizen  to 
the  national  level.  Others  have  argued  that  the  operation  occurred  while  the 
Congress  was  considering  a  law  project  that  gave  tools  to  the  government  to 
conduct  peace  dialogues  with  guerrilla  groups  in  Colombia. 

Sufficient  information  and  motives  exist  to  connect  the  FARC  on  the 
Londono  case.  The  intelligence  activities  and  judicial  investigations  found  that  the 
FARC  hired  a  criminal  organization  from  the  city  of  Cali  to  conduct  the 
operation.  106  jhis  group,  known  as  the  PEZ,  subcontracted  with  two  other  gangs 
from  Cali  and  Bogota  to  carry  out  the  attack.  The  criminal  organization  first 
formed  an  exploratory  team  to  gather  information  about  Londoho’s  routines  and 


"'03  Alvaro  Uribe’s  first  presidential  term  was  from  the  year  2002  until  2006. 

Caracol  Radio,  “Gobierno  Confirma  Que  Fernando  Londono  Habria  Recibido 
Amenazas”  [Government  confirms  that  Fernando  Londono  had  received  threats], 
http://www.caracol.com.co/noticias/judiciales/gobierno-confirma-que-fernando-londono-habia- 
recibido-amenazas/201 2051 6/nota/1 688946. aspx. 

"'11^  Jorge  A.  Restrepo,  “<j,Por  Que  Contra  Fernando  Londono  Hoyos?”  [Why  against 
Fernando  Londono  Hoyos?],  El  Espectador,  http://www.elespectador.com/noticias/judicial/contra- 
fernando-londono-hoyos-articulo-346485. 

"'ll®  Escrito  De  Acusacion  Caso  Fernando  Londono  [Bill  of  indictment  Londono  case],  FGN- 
50000-F-25  Escrito  De  Acusacion  Caso  Fernando  Londono  [Bill  of  Indictment  Londono  Case], 
Codigo  Unicode  la  investigacion  [prosecution’s  Unicode]  110016000028201201684,  2-62013). 
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daily  routes.  Most  of  the  terrorist  sub-network  participated  in  the  reconnaissance 
of  routes  and  the  collection  of  intelligence  about  his  itinerary. 

On  May  15,  2012,  the  terrorist  attack  took  place  in  Bogota.  Two  members 
of  the  criminal  organization  from  Cali  (Colombia)  placed  an  improvised  explosive 
device  (lED)  on  Fernando  Londoho’s  vehicle.  The  type  of  device  known  as  lapa 
(limpet  in  English)  had  not  been  used  in  the  country  before  although  it  had  been 
used  extensively  by  international  terrorist  organizations  such  as  ETA  in  Spain. 
According  to  judicial  investigations,  HDVSAP  was  the  terrorist  in  charge  of 
financing  this  terrorist  operation. He  paid  1,000  million  Colombian  pesos  to  the 
criminals  carrying  out  the  attack.  jhe  criminal  gang  used  this  money  to 
subcontract  members  of  other  organizations  and  obtain  the  necessary  logistics 
for  its  execution.  110  Figure  15  shows  members  of  the  FARC  and  the  criminal 
organizations  involved  in  the  terrorist  attack,  as  well  as  in  other  crimes  committed 
afterwards. Ill  Red  nodes  represent  members  of  the  FARC,  both  the  CMTF  and 
the  Sixth  Front,  while  yellow  nodes  represent  members  of  the  criminal  gangs. 


Luis  De  la  Calle  and  Ignacio  Sanchez-Cuenca,  “La  Seleccion  de  Victimas  en  ETA 
[ETA’S  selection  of  victims],”  Revista  Espanola  De  Ciencia  Politica  10  (2004):  53-79. 

"'08  This  is  the  same  terrorist  that  planned  and  executed  the  attack  on  El  Nogal  club  (see 
Chapter  IV). 

"'09  According  to  Colombian  financing  services  the  exchange  rate  for  that  period  was  nearly 
$1,771.60  pesos  per  dollar.  These  operations  had  an  approximate  cost  of  $  564.46  U.S.  dollars. 
This  information  was  drawn  from  Banco  de  la  Republica,  Serie  Historica  -  Tasa  De  Cambio 
Representativa  Dei  Mercado  (TRM)  [Historical  series  -  representative  market  exchange  rate]. 

''"'9  Ei  Tiempo,  “La  Teofilo  Pago  $  1.000  Millones  por  Atentado  a  Londoho”  [The  Teofilo  paid 
$1,000  million  for  attack  on  Londoho],  http://www.eltiempo.com/archivo/documento/CMS- 
12626865. 

''''''  Appendix  3.A  provides  a  list  of  open  sources  used  in  this  chapter. 
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Figure  15.  Overall  network  of  the  Londoho  case  study. 


The  criminal-terrorist  alliance  in  charge  of  conducting  the  attack  against 
Fernando  Londoho  was  a  small  group.  It  contained  25  people  linked  to  the  FARC 
and  the  subcontracted  criminal  groups.  Sixty-four  percent  of  its  members 
belonged  to  the  FARC  (colored  red  in  Figure  15)  and  36  percent  were  members 
of  the  criminal  organizations,  the  most  prominent  being  the  FEZ.  In  this  case,  the 
number  of  FARC  members  is  larger  than  those  belonging  to  the  criminal  groups. 
Nevertheless,  the  proportion  of  criminals  is  high,  which  suggests  that  the  leaders 
of  the  criminal  subgroup  decided  to  form  relationships  with  other  criminals  with 
the  objective  of  accomplishing  the  task  subcontracted  by  the  terrorist 
organization. 

The  network  is  also  diverse  in  terms  of  its  organizational  structure  and  the 
locations  in  which  it  operated.  The  FARC  members  belong  to  two  different 
hierarchical  levels.  The  first  includes  the  mid-level  commanders  of  the 
organization  in  charge  of  operational  units  such  as  the  CMTF  and  the  Sixth 
Front:  FIDVSAP,  MP,  and  AMPAJ.  The  second  corresponds  to  subordinated 
terrorists  who  perform  tasks  related  to  logistics,  terrorism,  and  the  group’s 
security.  This  level  includes  the  rest  of  the  FARC  members  identified  in  this 
investigation.  In  terms  of  its  areas  of  operations,  the  CMTF  has  direct  influence 
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over  Colombia  southern  departments  of  Huila  and  Caqueta,  while  the  FARC’s 
Sixth  Front  has  presence  in  the  western  region  of  the  country,  particularly  in  the 
department  of  Cauca.  One  might  think  that  geographic  distance  could  present  a 
disadvantage  in  the  communications  between  the  FARC’s  subgroups;  however, 
this  seems  to  not  have  been  an  issue  in  this  case.  In  fact,  HDVSAP  was 
presumably  270  kilometers  away  from  Bogota,  and  the  distance  did  not  affect  his 
capacity  to  guide  a  terrorist  attack  of  such  magnitude. 

The  area  of  operations  of  the  primary  criminal  organization,  FEZ,  was 
centered  in  Cali  city.  Its  relevant  leader  is  DF-TM,  who  along  with  his  brother  W- 
TM,  have  a  long  criminal  record  in  Colombia  and  Ecuador.  112  jhe  FEZ  conducts 
various  activities  related  to  theft,  extortion,  kidnapping,  and  murder.  According  to 
some  press  articles  quoting  one  of  the  arrested  terrorists,  DF-TM  and  FIDVSAP 
had  friendship  ties  because  of  the  presence  of  and  activities  carried  out  by  DF- 
TM  in  the  department  of  Caqueta.  This  suggests  that  the  friendship  started  a  long 
time  ago;  however,  this  investigation  could  not  determine  the  length  of  that 
relationship  based  on  the  available  data.  On  the  other  hand,  the  rest  of  the 
members  of  the  criminal  groups  operate  out  of  Cali  and  Bogota. 

FIDVSAP,  who  is  the  head  of  the  CMTF,  planned  and  directed  the  terrorist 
attack  against  Fernando  Londoho.  He  requested  the  authorization  to  carry  out 
the  plan  using  the  criminal  band  PEZ,  which  the  secretariat  granted. HDVSAP 
subcontracted  DF-TM  to  carry  out  the  attack.  On  April  2012  the  PEZ  traveled  to 
Bogota  and  contacted  a  second  criminal  organization  led  by  a  subject  identified 
as  UCBA.  The  TM  brothers  sought  UCBA’s  help  to  gather  information  about  the 
target’s  itineraries  and  mobilization  routes.  When  the  PEZ  members  returned  to 


"'"'2  Semana,  “<^Y  Que  Tal  Este  Delincuente?”  [And,  What  about  this  criminal?], 
http://www.semana.com/nacion/articulo/y-que-este-delincuente/331454-3. 

"'"'3  It  is  worth  mentioning  that  for  this  part  of  the  investigation,  the  analysis  focuses  on  the 
actions  of  the  actors  under  the  command  of  HDVSAP  and  related  exclusively  with  operational 
units  of  the  terrorist  organization.  Nevertheless,  it  could  be  argued  that  the  secretariat’s 
involvement  was  relevant;  however,  they  remained  in  a  position  of  observation  on  the  operation’s 
results.  The  secretariat’s  structure  has  remained  stable  since  the  year  2012  and  they  have  not 
lost  members  of  the  highest  hierarchical  level  during  the  last  two  years. 
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Cali,  they  approached  a  third  organization  from  sector  El  Vallado  in  Cali.  Their 
point  of  contact  was  CRGB,  who  was  in  charge  of  choosing  members  of  his 
group,  among  them  FCF,  NACH,  and  an  underage  person  known  as  CAPI,  who 
attached  the  lED  to  the  vehicle  in  which  Minister  Londoho  was  traveling. 

In  May  2012,  the  network  traveled  back  to  Bogota  one  week  before  the 
event.  After  the  attack,  the  members  fled  to  different  parts  of  Colombia.  However, 
on  August  2012,  the  National  Police  arrested  five  participants  including  UCBA, 
CRGB,  NACH,  FCF,  and  CAPI.  Moreover,  DF-TM  and  his  associates  sought 
help  from  HDVSAP.  They  requested  protection  from  the  FARC,  but  HDVSAP  did 
not  give  them  direct  shelter  and  redirected  the  request  to  the  FARC’s  Sixth  Front 
commander,  MP.  He  commanded  AMPAJ  to  incorporate  the  TM  brothers  into  the 
ranks  of  the  FARC.  This  decision  proved  to  be  profitable  for  the  Sixth  Front’s 
criminal  intentions  in  the  departments  of  Valle  and  Cauca. 

The  National  Police  conducted  operations  against  members  of  the  FARC’s 
Sixth  Front  on  June  2013.  The  police  force  arrested  terrorists  who  were  part  of 
the  group  that  was  developing  criminal  actions  to  improve  their  financial  status. 
Those  criminal  activities,  including  assaults  and  kidnappings,  were  planned  and 
executed  by  DF-TM.  Later,  on  August  2013,  the  Armed  Forces  hit  the  Sixth  Front 
again.  In  a  joint  operation,  AMPAJ  and  his  second  in  command,  CAPOEB,  were 
killed.  On  December  2013,  DF-TM  died  during  a  law  enforcement  operation 
along  with  other  FARC  members.  This  may  have  worried  HDVSAP,  which  could 
explain  why  he  strengthened  the  tie  between  his  group,  the  CMTF,  and  the 
FARC’s  Sixth  Front.  His  purpose  could  have  been  to  exploit  the  criminal 
capabilities  of  the  PEZ  members  embedded  in  the  Sixth  Front.  Nevertheless, 
these  ties  dissolved  after  a  police  operation  led  to  the  arrest  of  W-TM,  LAM  REG 
and  three  FARC  terrorists  on  February  2014  in  the  department  of  Huila,  southern 
Colombia. 
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B.  MEMBERS  OF  THE  TERRORIST  AND  CRIMINAL  NETWORK 

This  analysis  now  turns  to  an  examination  of  the  actors’  centrality 
measures  over  time  (see  Table  In  terms  of  degree  centrality,  the  TM 

brothers  consistently  maintained  the  greatest  number  of  ties  in  the  organization. 
This  suggests  they  were  able  to  maintain  influence  over  the  network’s  behavior. 
The  transition  of  the  TM  brothers  and  their  associate  LAMREG  to  the  terrorist 
group  influenced  the  structural  position  of  AMPAJ.  He  had  the  responsibility  to 
secure  the  PEZ  members  who  were  fleeing  from  justice. 

At  the  beginning  of  the  alliance,  DF-TM  was  the  person  with  the  highest 
eigenvector  score.  This  makes  sense  given  that  he  acted  somewhat 
autonomously  in  planning  and  executing  the  attack,  which  suggests  he  was  the 
organization’s  most  important  person.  After  the  attack,  the  network  dispersed  and 
the  eigenvector  scores  distributed  evenly  in  most  of  the  actors.  One  could 
analyze  this  distribution  from  the  perspective  of  the  conditioning  of  the  criminal 
gang  members  to  the  new  regime  of  the  FARC’s  Sixth  Front.  In  other  words,  the 
PEZ  members  felt  they  were  on  equal  position  with  the  terrorists  because  of  the 
task  they  accomplished  on  the  FARC’s  behalf.  In  a  final  stage  of  the  alliance,  W- 
TM,  after  the  death  of  his  brother  DF-TM,  had  the  highest  eigenvector  score 
because  he  shared  his  brother’s  ties  with  HDVSAP  and  other  FARC  members. 

HDVSAP  scored  highest  in  terms  of  betweenness  centrality.  The 
combination  of  his  role  as  commander  of  a  mobile  column  and  his  access  to  the 
secretariat  helps  explain  his  brokerage  power.  The  betweenness  scores  also 
suggest  that  the  TM  brothers  possessed  brokerage  potential  within  the  network. 
It  appears  that  they  took  advantage  of  their  knowledge  and  criminal  experience 
to  gain  a  position  within  the  network  in  order  to  wield  more  influence.  Another 
actor  in  position  of  brokerage  was  AMPAJ.  He  had  the  power  to  liaise  between 


Appendix  3.C  provides  a  list  of  the  top  ten  actors  with  their  centrality  measures  for  every 
critical  moment. 
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the  FARC  and  FEZ,  which  allowed  him  to  promote  criminal  activities  to  benefit 
the  financial  conditions  of  the  Sixth  Front  via  assaults  and  kidnappings. 

Closeness  centrality  reveals  an  actor’s  potential  access  to  resources. 
Over  the  course  of  the  operation  closeness  scores  had  a  homogenous 
distribution.  Actors  that  registered  similar  scores  belonged  to  the  same  clusters. 
In  the  first  few  periods  of  the  network,  particularly  during  the  terrorist  attack, 
members  of  the  criminal  groups  continuously  formed  ties  until  all  of  them 
established  a  relationship.  The  TM  brothers  did  not  enter  at  the  grassroots  level 
of  the  terrorist  group.  Instead,  they  arrived  in  the  upper  echelon  where  they  led 
operations  and  had  ties  with  the  commanders  of  the  terrorist  subgroup. 


Table  12.  The  top  ten  actors  of  the  Londoho’s  overall  network  sorted 

by  highest  value. 


N° 

Degree  (norm.) 

Closeness  (norm.) 

Betweenness  (norm.) 

Eigenvector 

(norm.) 

1 

DF-TM  and  W-TM  (54.16) 

DF-TM  and  W-TM  (68.5) 

AMPAJ  (38.05) 

W-TM  (54.8) 

2 

LAMREG  (50) 

LAMREG  (64.8) 

DF-TM  (32.5) 

LAMREG  (52.8) 

3 

AMPAJ  (41.6) 

AMPAJ  (61.5) 

W-TM  (19.7) 

DF-TM  (51.2) 

4 

UCBA,  CARGB,  NACH, 
FCAF,  and  CAPI  (29.16) 

JLGB  (51.06) 

LAMREG  (14.5) 

UCBA,  CARGB, 
NACH,  FCAF, 
and  CAPI  (40.9) 

5 

Give  (25) 

HDVSAP  (50) 

HDVSAP  (11.4) 

AMPAJ  (26.5) 

6 

HDVSAP,  RCGM,  CCVC, 
SPRVP,  DAPR,  and 
ESPG  (20.8) 

UCBA,  CARGB,  NACH, 
FCAF,  and  CAPI  (48.9) 

JLGB  (2.8) 

JLGB  (21.4) 

7 

JLGB,  Decs,  and  HAJPE 
(16.6) 

RCGM  (46.15) 

MAPSP  (2.19) 

RCGM  (20.5) 

8 

MAPSP,  JCG,  FCMP,  and 
ARAP  (12.5) 

Decs  and  HAJPE  (43.6) 

Give  (1.6) 

Decs  and 
HAJPE  (18.6) 

9 

CAPOEB  (8.3) 

Give,  MAPSP,  JCG,  FCMP, 
and  ARAP  (42.8) 

RCGM  (1.14) 

HDVSAP  (17.1) 

10 

FGRC  (4.16) 

CCVC,  SPRVP,  DAPR,  and 
ESPG  (42.10) 

- 

Give  (9.8) 

115  £/  Pa/S,  “Las  Fare  Asaltaron  Carro  De  Valores  en  La  Via  Santander  de  Quilichao-Cali” 
[The  FARC  Assaulted  a  Values  Transportation  Vehicle  on  the  Way  between  Santander  de 
Quilichao  and  Cali],  http://www.elpais.com.co/elpais/judicial/noticias/dos-policias-heridos-dejo- 
ataque-carro-valores-panamericana. 
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C.  TOPOGRAPHICAL  DIMENSIONS  OF  THE  OVERALL  NETWORK 

The  overall  network  tends  to  lie  in  the  cosmopolitan  dimension  of  network 
topography  (see  Table  13).  The  network’s  density  is  0.24,  which  suggests  that 
the  network  is  relatively  sparse  and  that  actors  did  not  form  as  many  ties  as  they 
could  have.  The  network’s  average  degree  is  5.84  and  its  clustering  coefficient  is 
0.62.  One  could  infer  from  the  small-world  quotient  of  2.56  that  network 
resources  reached  actors  rapidly;  it  could  also  explain  the  fact  that  actors 
received  innovative  ideas  with  less  resistance,  assimilating  changes  quickly 
because  of  the  influence  of  exogenous  factors. 

The  network  also  tends  to  be  heterarchical;  however,  its  closeness 
centralization  score  suggests  that  it  is  moderately  so.  This  measure,  which  was 
45.17  percent,  indicates  that  a  small  set  of  actors  had  greater  access  than  others 
to  information  and  resources  within  the  network,  and  indeed  the  previous  section 
identified  the  TM  brothers  as  the  actors  with  the  highest  closeness  centrality 
scores.  This  potential  accessibility  was  important  to  them  in  every  critical  moment 
during  the  length  of  the  alliance  (see  Table  11).  When  one  compares  these 
scores  with  those  of  the  Isaias  Duarte  murder  network,  39.34  percent,  and  the  El 
Nogal  attack  network,  38.02  percent,  one  could  argue  that  closeness 
centralization  and  centrality  are  significant  indicators  of  overall  network  behavior. 

The  other  centralization  measures  are  lower.  For  example,  degree 
centralization  equals  32.43  percent,  which  suggests  that  there  was  not  a  single 
actor  in  position  of  influencing  the  overall  activity  of  the  network.  Similarly, 
betweenness  centralization  (34.46  percent)  indicates  that  brokerage  potential 
was  widely  distributed  among  actors.  It  is  lower  than  the  other  two  networks 
(Isaias  Duarte  49.0  percent;  El  Nogal  50.72  percent),  which  may  indicate  the 
FARC  evolved  in  their  method  of  subcontracting  with  criminal  gangs.  It  may  have 
concluded  that  it  was  more  important  to  have  access  to  information  than  trying  to 
control  the  flow  of  resources.  Finally,  eigenvector  centralization,  42.17  percent, 
indicates  that  there  was  a  relatively  high  proportion  of  actors  connected  to  central 

others,  particularly  between  members  of  the  Sixth  Front  and  the  FEZ. 
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Table  13.  Summary  of  the  Londoho  attack  overall  network’s 

centralization. 


CENTRALIZATION  MEASURES 

SCORES 

Degree  centralization 

32.43% 

Betweenness  centralization 

34.46% 

Eigenvector  centralization 

42.17% 

Closeness  centralization 

45.17% 

Standard  deviation  is  another  measure  of  centralization  and  indicates  that 
it  scored  lowest  in  terms  of  degree  and  closeness  centrality,  suggesting  that  most 
members  of  the  network  had  scores  close  to  the  mean.  These  scores  suggest 
that  a  potential  power  to  access  resources  and  actors  was  possible  for  a  small 
set  of  members  like  the  TM  brothers,  LAMERG,  AMPAJ,  and  HDVSAP.  Table  14 
summarizes  the  standard  deviation  scores. 


Table  14.  Set  of  alternative  measures  regarding  the  network’s 

standard  deviation. 


STANDARD  DEVIATION  SCORES 

Degree  standard  deviation  3.158 

Betweenness  standard  deviation  10.284 

Eigenvector  standard  deviation  17.012 

Closeness  standard  deviation  9.65 


D.  NETWORK’S  EVOLUTION  OVER  TIME:  A  LONGITUDINAL  ANALYSIS 

The  network  had  a  life  span  of  23  months.  The  planning  process  of  the 
terrorist  attack  against  Londoho  began  in  April  2012,  and  the  security  agencies 
carried  out  the  last  arrests  in  February  2014.  According  to  the  network  timeline, 
each  period  corresponds  to  one  month,  which  facilitates  analysis  regarding  its 
evolution  and  the  identification  of  drastic  changes  in  its  structure.  The  evolution 
of  the  network  occurred  in  seven  critical  moments  that  influenced  the  behavior  of 
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the  actors.  These  critical  moments  correspond  to  law  enforcement  operations 
that  caused  the  exit  or  entry  of  members  to  the  organization. 

During  the  first  period  of  the  network,  it  contained  1 1  actors  who  planned 
and  conducted  the  attack.  DF-TM,  who  had  direct  contact  with  HDVSAP  and  was 
the  overall  decision  maker,  was  in  charge  of  imparting  responsibilities  for  each 
member  of  the  alliance  in  Bogota.  One  might  argue  that  this  operation  did  not 
have  extreme  compartmentalization  settings  among  the  criminals.  In  fact,  the 
closeness  centralization  of  37.65  percent  suggests  that  members  had  similar 
access  to  resources  and  other  members  of  the  network.  The  mesh-type  shape  of 
the  organization  suggests  this  subgroup  was  highly  connected.  Figures  16-19 
identify  the  variation  of  centralization  regarding  the  standard  deviation  of  each 
critical  moment, 

Once  the  group  conducted  the  terrorist  attack,  it  began  the  transition  of 
criminals  to  the  FARC’s  ranks.  Between  the  times  3  and  15  (June  2012  to  June 
2013)  one  can  observe  increasing  relationships  with  new  actors  who  belong  to 
the  FARC’s  Sixth  Front.  The  network  grew  from  1 1  actors  to  25  actors  before 
declining  to  20  after  the  arrest  of  5  members  from  the  criminal  gangs.  In  the 
period  when  the  network  had  25  actors  it  registered  an  average  degree  of  5.8. 
Between  the  times  6  and  15  (September  2012  to  June  2013)  the  network  had  20 
actors  and  its  average  degree  decreased  to  4.8.  This  decrease  could  suggest 
that  the  network  did  not  replace  lost  ties,  which  may  have  rendered  it  vulnerable. 
The  clustering  coefficient  dropped  from  0.85  to  0.58  between  the  first  period  and 
time  15  (April  2012  to  June  2013),  indicating  that  over  a  year  after  the  attack,  ties 
within  the  network  stabilized.  This  might  indicate  that  actors  gave  more  effort  to 
strengthen  trust  among  them  rather  than  forming  new  relationships. 

Between  times  16  and  22  (July  2013  to  January  2014),  the  police 
conducted  operations  against  the  network.  One  law  enforcement  operation  in 

'I''®  Appendix  3.D  provides  a  chart  with  topographical  measures  and  centralization  in  every 
critical  moment.  Likewise,  Appendix  3.E  provides  a  visualization  of  the  network’s  transformation 
over  time. 
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August  2013  led  to  the  killing  of  AMPAJ  and  his  second  in  command,  CAPOEB. 
This  strike  removed  a  terrorist  with  high  betweenness  centrality.  This  potential 
power  of  brokerage  allowed  him  to  earn  a  relevant  position  in  the  FARC  because 
of  the  criminal  activities  he  was  carrying  out  along  with  the  TM  brothers. 
Likewise,  on  December  2013  DF-TM  was  killed  during  a  police  operation  with 
terrorists  from  the  FARC’s  Sixth  Front  and  the  CMTF.  The  Colombian  authorities 
had  focused  their  efforts  on  localizing  and  arresting  this  individual  not  only  for  his 
involvement  in  the  terrorist  attack  against  Londoho,  but  also  for  his  participation 
in  the  kidnapping  of  two  police  agents. 

The  alliance  between  the  PEZ  and  the  FARC  ended  because  of  the  arrest 
of  W-TM  and  LAMREG  on  February  2014.  According  to  press  articles,  the  death 
of  AMPAJ  and  DF-TM  concerned  FIDVSAP.n^  jhis  warlord  had  ordered  his 
subordinates  to  strengthen  the  cooperation  between  the  CMTF  and  the  Sixth 
Front.  Therefore,  he  exploited  the  criminal  capabilities  of  W-TM  and  his  associate 
LAMREG.  These  criminals  were  arrested  with  members  of  the  FARC  when  they 
were  moving  weapons  between  the  departments  of  Cauca  and  Huila.  At  this 
moment  the  network  dropped  to  nine  members,  which  increased  the  clustering 
coefficient,  but  reduced  its  average  degree  to  3.5.  These  measures  suggest  that 
the  network  increased  its  connectivity,  or  even  after  the  removal  of  these  actors, 
the  network  was  still  relatively  cohesive. 


Noticias  Caracal,  “Primeras  Imageries  de  La  Liberacion  de  Dos  Policfas  Secuestrados 
por  FARC”  [First  images  of  two  policemen  released  who  were  kidnapped  by  the  FARC], 
http://www.noticiascaracol.com/nacion/primeras-imagenes-de-la-liberacion-de-dos-policias- 
secuestrados-por-farc. 

'I''®  Jose  G.  Perez,  “El  Fin  de  La  Alianza  de  Las  Fare  con  El  ‘Parche  De  Zuley’”  [The  end  of 
the  alliance  of  the  FARC  with  the  ‘el  Parche  De  Zuley"],  El  TIempo, 
http://www.eltiempo.com/justicia/alianza-de-las-farc-con-el-parche-de-zuley-llego-a-su- 
fin  13916279-4. 
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Figure  16.  Longitudinal  scores  of  degree  centralization  and  standard 
deviation  in  the  Londoho  attack  network. 
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Figure  17.  Longitudinal  scores  of  eigenvector  centralization  and  standard 

deviation  in  the  Londoho  attack  network. 
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Figure  18.  Longitudinal  scores  of  betweenness  centralization  and 
standard  deviation  in  the  Londoho  attack  network. 
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Figure  19.  Longitudinal  scores  of  closeness  centralization  and  standard 

deviation  in  the  Londoho  attack  network. 


1.  Social  Network  Change  Detection 

SNCD  identifies  significant  changes  in  all  four  measures  of  centralization. 
The  first  occurred  during  the  times  5  and  6  (August-September  2012)  where 
there  were  significant  decreases  in  degree  and  closeness  centralization.  The 
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arrest  of  the  first  members  responsible  for  the  execution  of  the  terrorist  attack 
could  explain  this  decrease.  Degree  centralization  varies  from  32.43  percent  to 
30.41  percent.  Decentralization  of  the  criminal  subgroup  could  constitute  a  crisis 
in  which  actors  seek  to  base  their  relationships  on  trust,  On  the  other  hand, 
closeness  centralization  decreases  from  45.17  percent  to  41.66  percent,  and  its 
standard  deviation  went  from  9.65  to  8.96.  The  transformation  of  the  network  in 
time  6  does  not  allow  this  analysis  to  identify  an  actor  with  larger  capabilities  to 
contain  potential  power  to  access  resources  and  actors  quickly  in  the  network. 
The  formation  of  ties  under  these  circumstances  could  reveal  that  factors  like 
prestige  are  necessary  to  build  trust.  Likewise,  criminal  actors’  experiences  and 
culture  could  have  been  assessed  by  the  FARC,  in  order  to  identify  common 
features  that  would  help  them  to  strengthen  ties  easier.  120  Figures  20  and  21 
show  the  cumulative  sum  control  chart  detecting  changes  in  four  measures  of 
centralization. 


Figure  20.  SNCD  reflects  changes  in  closeness  and  betweenness 

centralization. 


McCarthy,  Hagan,  and  Cohen,  “Uncertainty,  Cooperation,  and  Crime:  Understanding  the 
Decision  to  Co-Offend,”  174. 

Lin,  Social  Capital:  A  Theory  of  Social  Structure  and  Action,  38. 
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--*--  Deaease  Increase 

Figure  21 .  SNCD  illustrate  transformation  in  eigenvector  and  degree 

centralization. 

During  the  same  periods,  times  5  and  6,  SNCD  detects  a  statistically 
significant  increase  in  betweenness  centralization.  It  increases  from  34.46 
percent  to  39.17  percent,  and  its  standard  deviation  increases  from  10.28  to 
1 1 .63.  These  scores  contribute  to  understanding  the  FARC’s  role  in  the  context 
of  protectors  of  the  FEZ  members.  At  the  moment  of  the  criminal’s  transition  into 
the  FARC,  the  terrorist  group  protected  the  TM  brothers  and  LAMREG  until  their 
role  upgraded  to  belong  formally  to  the  FARC.  As  a  protector,  AMPAJ  is  the 
liaison  between  the  FARC  and  the  criminal  organizations.  One  could  argue  that 
his  position  of  brokerage  allowed  him  to  propose  to  his  superiors  that  they  recruit 
these  criminals  as  new  FARC  members.  Although  this  investigation  does  not 
have  data  regarding  these  orders,  it  is  possible  that  the  FARC’s  secretariat  was 
involved  in  this  decision. 

There  are  other  periods  registering  significant  changes  in  eigenvector  and 
degree  centralization.  Figure  22  indicates  a  significant  change  in  eigenvector 
centralization  occurred  between  periods  15  and  16.  These  periods  are  the 
prelude  of  law  enforcement  actions  against  the  Sixth  Front.  Flowever,  these 
operations  against  the  FARC  could  have  opened  a  wider  range  of  action  for  the 
TM  brothers  who  took  advantage  of  these  strikes  to  approach  FARC  leaders  and 
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renew  the  alliance  with  HDVSAP.  SNCD  of  degree  centralization  indicates  that 
significant  changes  occurred  during  times  21  and  22  (December  2013  and 
January  2014)  suggesting  that  a  small  set  of  actors  may  have  increased  their 
ties;  this  appears  to  be  the  case  with  W-TM  and  LAMREG  who  would  later  be 
direct  heirs  of  the  alliance  built  by  DF-TM.121 

E.  CONSIDERATIONS  FOR  THE  ATTACK  AGAINST  FERNANDO 

LONDONO 

The  exploratory  and  longitudinal  analysis  of  this  dark  network  leads  to 
interesting  findings  regarding  the  security  and  efficiency  tradeoff.  The  FARC 
subcontracted  a  criminal  group  to  carry  out  the  attack  and  obtained  benefits  for 
this  decision,  such  as  increasing  their  security  in  terms  of  legal  and  physical 
protection.  One  could  argue  that  the  legal  protection  is  the  most  valuable  aspect 
for  their  interests.  Law  enforcement  agencies  and  the  attorney  general’s  office 
encountered  difficulties  in  gathering  evidence  and  prosecuting  the  FARC  as  the 
masterminds  for  terrorist  actions  like  the  one  described  here.  Likewise,  the  FARC 
avoided  physical  damage,  which  is  another  security  perspective  for  their  benefit. 
In  this  case,  the  FARC  let  the  criminal  organization  plan  and  execute  the 
operation,  which  reduced  the  risk  of  their  members  being  arrested  or  killed  during 
the  operation. 

The  second  relevant  finding  is  that  the  FARC  formed  a  highly  efficient 
partnership  with  a  criminal  gang,  which  allowed  it  to  detach  itself  from  the  details 
of  the  terrorist  plan.  Once  the  criminal  group  fulfilled  its  task,  the  FARC  sought  to 
make  use  of  them  in  other  activities.  Nevertheless,  it  is  possible  that  HDVSAP 
did  not  want  to  add  the  members  of  PEZ  to  his  subgroup.  Instead,  he  transferred 
that  responsibility  to  another  terrorist  structure  away  from  his  area  of  operations, 
which  could  indicate  that  he  knew  that  the  authorities  would  seek  to  locate  and 
arrest  all  members  of  the  network.  Hence,  HDVSAP’s  personal  option  was  to 
help  his  associates  without  endangering  the  security  of  his  group. 

''21  Appendix  3.F  depicts  graphs  visualizing  these  changes  using  ORA. 
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Also  interesting  was  the  behavior  of  the  criminal  actors  when  they  entered 
into  the  FARC’s  ranks.  One  could  argue  that  the  objective  of  the  criminal 
organization  was  to  earn  an  extraordinary  amount  of  money  and  a  relevant  label 
of  prestige  among  their  peers  in  the  criminal  world.  Nevertheless,  following  the 
first  operations  of  the  National  Police,  their  goals  changed  towards  their  survival 
as  new  members  of  the  FARC.  In  this  sense,  individual  skills  and  a  criminal 
background  were  major  assets  to  convince  the  FARC’s  Sixth  Front  members 
they  were  essential  to  the  organization.  Nevertheless,  their  criminal  activities  only 
attracted  more  attention  and  ultimately  ended  the  lives  of  several  terrorists, 
including  members  with  broad  experience  within  the  FARC. 

The  transformation  of  this  network  is  a  sample  of  the  evolution  of  the 
FARC’s  strategic  vision  regarding  alliance  formation  with  criminal  gangs. 
However,  an  underlying  factor  of  attention  for  this  transformation  rests  on  the 
group’s  financial  capabilities  to  promote  terrorist  attacks.  Drug  trafficking  remains 
the  primary  source  of  revenue.  The  FARC  earns  nearly  $1,5  billion  dollars  from 
its  drug  operations,  which  is  about  4.5  to  7.5  percent  of  Colombia’s  gross 
domestic  product.  122  This  financial  capacity  is  the  greatest  attraction  for  criminal 
groups  that  seek  alliances  with  the  FARC  in  order  to  execute  terrorist  attacks  on 
their  behalf.  123 


"'22  Revista  Dinero,  “La  Chequera  de  Las  FARC”  [The  FARC’s  checkbook], 
http://www.dinero.com/edicion-impresa/pais/articulo/los-lavados-activos-farc/190928. 

Daniel  Mejia  and  Daniel  Rico,  “La  Microeconomia  de  La  Produccion  y  Trafico  De 
Cocaina  en  Colombia”  [Microeconomics  of  cocaine  production  and  trafficking  in  Colombia], 
Documentos  Centro  de  Estudios  Sobre  Desarrollo  Economico,  July  2010. 
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VI.  CONCLUSIONS 


The  objective  of  this  investigation  was  to  shed  light  on  the  potential  risk  to 
Colombia’s  security  from  a  segment  of  the  FARC  that  rejects  the  current  peace 
process.  It  examined  three  relatively  recent  case  studies  demonstrating  the 
FARC’s  strategic  use  of  alliances  with  criminal  organizations,  which  continue  to 
destabilize  the  country. ''24  For  the  FARC,  these  alliances  appear  to  provide 
several  operational  advantages  in  the  post-conflict  era,  including  plausible 
deniability  in  terrorist  attacks.  For  the  criminal  organizations,  these  alliances 
bolster  their  financial  resources  and  help  them  earn  prestige  among  their  peers  in 
the  criminal  world. 

The  use  of  alliances  at  the  end  of  conflicts  is  not  a  new  phenomenon  and 
has  been  seen  in  similar  situations  in  the  past,  including  at  the  end  of  conflicts  in 
Nicaragua,  Guatemala,  and  El  Salvador.  Nevertheless,  this  research  is  unique  in 
that  it  utilizes  both  historical  and  social  network  analysis  to  examine  empirically 
these  alliance  networks.  Moreover,  it  identifies  common  characteristics  that  may 
help  prevent  or  minimize  further  violence. 

A.  ASSESSMENT  OF  THE  HISTORICAL  CONTEXT 

The  FARC  have  adapted  their  methods  to  conduct  terrorist  operations  by 
learning  to  exploit  their  allies’  capabilities.  During  past  peace  processes,  the 
FARC  continued  to  carry  out  its  own  operations  in  a  relatively  independent 
manner.  For  example,  the  FARC  confronted  the  state  head-on  during  the 
1999-2002  peace  process. ''25  |t  appears  to  have  transitioned  to  a  policy  of 
forming  alliances  with  other  organizations,  one  that  allows  members  of  the  FARC 


''24  Semana,  “El  Matrimonio  Diabolico  Entre  Las  FARC  y  Los  Usuga”  [The  diabolic  marriage 
between  the  FARC  and  the  Usugas],  http://www.semana.com/nacion/articulo/el-matrimonio- 
diabolico-entre-las-farc-los-usuga/403466-3. 

''25  Roman  D.  Ortiz,  “Insurgent  Strategies  in  the  Post-Cold  War:  The  Case  of  the 
Revolutionary  Armed  Forces  of  Colombia,”  Studies  in  Confiict  &  Terrorism  25,  no.  2  (2002): 
136-140. 
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to  subcontract  terrorist  operations  to  individuals  and  groups  operating  under  a 
“model  of  accountability.”  In  other  words,  the  criminal  gangs  are  granted 
considerable  freedom  in  planning  and  executing  the  operations,  but  at  the  same 
time,  they  (and  not  the  FARC)  are  answerable  for  their  actions. 

The  FARC’s  change  in  policy  is  based  on  several  advantages  of 
outsourcing  terrorism.  First,  it  can  focus  on  its  strategic  goals  by  leaving  the 
details  of  conducting  criminal  and  terrorist  operations  to  the  groups  to  which  it  is 
outsourcing  violence.  Second,  it  can  hide  its  real  intentions  and  capabilities  from 
the  public,  which  allows  it  to  select  which  actions  to  claim  and  advertise  as  a 
show  of  force.  Third,  it  can  deny  its  involvement  in  politically  sensitive  events  that 
may  produce  backlash  from  the  population.  In  addition  to  these  advantages,  it  is 
important  to  understand  the  social  structure  of  these  alliances  in  order  to  fully 
understand  their  nature  and  to  make  thoughtful  considerations. 

B.  SOCIAL  NETWORK  ANALYSIS 

1.  Topographical  Dimensions 

The  three  networks  have  several  structural  characteristics  in  common. 
One  is  their  relatively  small  size.  None  of  the  networks  consisted  of  more  than  30 
members,  which  is  interesting  given  the  size  of  the  organizations  involved.  A 
likely  factor  limiting  their  sizes  is  the  FARC’s  focus  on  maintaining  plausible 
deniability  and  keeping  the  operations  covert. 

The  other  network  topographical  metrics  used  in  this  analysis  also 
highlight  some  interesting  patterns  (see  Table  15).  For  instance,  they  suggest 
that  the  groups  tend  to  be  in  the  cosmopolitan  dimension  in  terms  of  cohesion, 
which  suggests  that  tie  formation  was  somewhat  limited  among  actors  in  the 
networks.  For  example,  both  the  El  Nogal  and  the  Londoho  networks 
demonstrated  relatively  low  levels  of  clustering  as  indicated  by  their  clustering 
coefficient.  On  the  other  hand,  the  Isaias  Duarte  network  had  a  larger  clustering 
coefficient,  indicating  that  one  of  its  segments  was  highly  connected.  This  would 
suggest  that  this  particular  network  may  not  fit  within  the  cosmopolitan  dimension 

74 


of  clustering.  However,  the  small-world  quotient  and  an  abundance  of  weak  ties 
within  each  network  both  suggest  all  three  networks  fall  on  the  cosmopolitan  side 
of  the  dimension. 

The  networks  also  appear  to  balance  their  position  within  the  hierarchical 
and  heterarchical  dimension  of  network  topography.  The  centralization  scores 
across  all  four  measures  used  throughout  the  previous  chapters  are  all  relatively 
balanced  (at  least  mathematically)  between  0.0  and  0.1.  In  other  words,  there 
was  not  a  single  actor  within  each  network  who  had  the  capacity  to  control  or 
influence  the  networks  altogether.  This  balance  may  help  explain  why  the 
networks  were  able  to  conduct  their  criminal  and  terrorist  operations  efficiently. 
For  the  Isaias  Duarte  and  the  El  Nogal  networks,  their  highest  centralization 
measure  was  betweenness,  suggesting  that  they  had  actors  who  were  mainly 
FARC  members,  with  the  potential  to  serve  as  brokers  between  clustered 
segments.  On  the  other  hand,  the  Londoho  network  was  largely  centralized  in 
terms  of  the  closeness  centralization,  which  implies  that  some  actors  could 
access  other  actors  and  resources  quickly.  Table  15  summarizes  the  overall 
features  of  networks’  topographical  dimensions. 


Table  15.  Summary  of  networks’  topographical  dimensions. 


Features 

Isaias  Duarte 

El  Nogal  Club 

Fernando 

Londono 

Size 

21 

27 

25 

Average  Degree 

+/-  Dense 

Sparse 

Sparse 

Clustering 

coefficient 

Medium-High 

Low-Medium 

Low-Medium 

Small-world 

quotient 

Low-Medium 

Low-Medium 

Low-Medium 

Ties 

Strong  ties 

Weak  ties 

Weak  ties 

Centralization 

Low-Medium 

Low-Medium 

Low-Medium 

Standard 

Low-Medium 

Low-Medium 

Low-Medium 

deviation 
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2.  Measures  of  Centrality 

Overall,  the  FARC  members,  specifically  formal  leadership,  were  more 
central  and  more  influential  than  the  criminal  group  members  in  all  three 
networks,  which  makes  sense  given  these  were  FARC-driven  operations.  That 
being  said,  two  other  possible  explanations  may  exist.  The  first  one  is  based  on 
the  FARC’s  overall  network  structure  and  the  second  on  the  group’s  operational 
coverage  of  large  portions  of  Colombia.  In  terms  of  the  former,  the  FARC’s 
network  structure  allows  the  leadership  to  be  aware  of  the  evolution  of  the 
terrorists’  plans,  and  if  necessary,  to  intervene  in  the  decision-making  process 
despite  their  attempts  to  remain  hidden  in  the  face  of  counterterrorism  efforts.  In 
terms  of  the  latter,  the  FARC  maintains  significant  presence  in  a  wide  range  of 
areas  across  the  country. 

The  overall  centrality  results  suggest  that  the  FARC  sought  to  sustain 
control  in  their  operations  and  that  the  commanding  staff  was  completely  aware 
of  every  operational  plan.  In  fact,  the  FARC  members  consistently  had  the 
largest  amount  of  ties,  including  permanent  access  to  the  highest  hierarchical 
levels  of  the  organization.  Regarding  the  FARC’s  secretariat,  it  is  important  to 
highlight  that  they  are  located  in  remote  and  almost  inaccessible  areas,  but  they 
can  still  manage  to  gain  access  to  their  networks  and  their  resources  at  any  time. 
Similarly,  the  front’s  leaders  had  the  ability  to  command  these  operations  from  a 
distance.  Most  of  these  terrorists  have  the  potential  power  to  serve  as  brokers 
and  use  means  to  access  information  and  resources  quickly. 

3.  Longitudinal  Analysis 

Both  endogenous  and  exogenous  factors  influenced  the  transformation  of 
the  networks  over  time. ''26  |n  terms  of  endogenous  factors,  the  FARC  eliminated 
several  criminal  actors  across  the  three  networks.  In  the  El  Nogal  attack,  the 
FARC  killed  the  perpetrators  and  appear  to  have  only  cared  about  accomplishing 

''26  Ian  McCulloh  and  Kathleen  M.  Carley,  Detecting  Change  in  Longitudinai  Sociai  Networks 
(New  York:  Military  Academy  West  Point  Network  Science  Center,  2011). 
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its  goal  of  a  successful  operation.  In  the  Duarte  and  El  Nogal  cases,  the  criminal 
gangs  also  appeared  to  be  expendable  in  the  sense  that  the  FARC  did  not  see 
additional  value  in  them  after  the  events.  The  Londoho  case  shows  the  effect  of 
additional  endogenous  factors,  namely  the  acceptance  of  criminal  members  into 
their  formal  ranks. 

In  terms  of  exogenous  factors,  the  most  relevant  are  the  effects  caused  by 
law  enforcement  operations.  These  actions  had  a  significant  effect  on  the 
structural  composition  of  the  organizations.  They  appear  to  have  caused  the 
networks  to  become  more  cohesive  and  centralized,  suggesting  that  the  state’s 
operations  were  able  to  reach  members  in  the  periphery  of  the  networks,  but  not 
enough  to  harm  the  core  of  these  organizations. ''27  That  being  said,  the 
application  of  SNCD  showed  law  enforcement  operations  had  particularly 
noticeable  effects  on  both  betweenness  and  closeness  centralization. ''28 

C.  CONSIDERATIONS  FOR  THE  AUTHORITIES 

The  characteristics  of  these  networks,  based  on  both  historical  and  social 
network  analyses,  present  a  set  of  possible  strategic  implications  to  counter  the 
FARC-criminal  alliance  phenomenon.  According  to  Roberts  and  Everton, 
strategic  options  for  countering  dark  networks  can  be  divided  into  two  broad 
categories:  kinetic  and  non-kinetic.''29  Kinetic  strategies  refer  to  the  targeting  of 
persons,  groups,  and  organizations  through  aggressive  means  in  order  to 
neutralize,  capture,  or  eliminate  them.  The  non-kinetic  approach,  on  the  other 
hand,  involves  less  aggressive  ways  and  its  purpose  is  to  secure  the  population’s 
safety  and  support  and  undermine  the  enemy’s  influence  and  control.  It  is  indirect 
and  seeks  to  affect  terrorists  or  criminal  groups  physically  and  psychologically. 


''27  Kathryn  Oliver  et  al.,  “Covert  Network  Data:  A  Typology  of  Effects,  Processes,  Practices 
and  Structures”  (paper  presented  at  Sunbelt  XXXIV,  the  Annual  Meeting  of  the  International 
Network  for  Social  Network  Analysis  in  St.  Pete  Beach,  FL,  February  18-23,  2014). 

''28  McCulloh  and  Carley,  Social  Network  Change  Detection,  1-20. 

''29  Nancy  Roberts  and  Sean  F.  Everton,  “Strategies  for  Combating  Dark  Networks,”  Journal 
of  Social  Structure  12,  no.  2  (2011):  5. 
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The  first  strategic  implication  has  to  do  with  the  FARC’s  leadership  at  the 
front  level.  Decision  makers  should  focus  on  increasing  the  armed  forces’ 
operations  against  the  FARC  fronts’  leaders,  particularly  those  terrorists  who 
reject  the  peace  agreements.  These  actors  appear  to  be  critical  in  the  formation 
of  alliances  because  they  are  scouting  new  criminal  fields  to  improve  their 
financial  status.  In  addition,  they  will  structure  new  organizations  with  criminal 
and  terrorist  capabilities  in  order  to  test  the  state  in  its  mission  to  provide 
security,  ranging  from  the  citizen  to  national  security.  A  possible  strategy  is  to 
increase  and  sustain  the  state’s  presence  in  geographical  areas  of  criminal 
dominion  where  there  has  been  a  security  gap  historically.  The  longitudinal 
analysis  of  this  research  suggests  that  the  immediate  reaction  of  criminals  after 
conducting  an  operation  is  to  seek  shelter  in  what  they  call  their  sanctuaries. 
Therefore,  the  presence  of  the  police  and  military  forces  in  these  zones  can 
motivate  the  dispersion  of  criminals  and  enforce  their  displacement.  This  action 
could  have  similar  effects  to  network’s  fragmentation  when  one  seeks  to  isolate 
actors.  In  this  sense,  the  terrorists  might  find  limitations  to  elaborate  new  plans, 
and  this  could  bring  about  their  exposure  and  ultimately  lead  to  their  location  and 
neutralization. 

A  second  strategic  implication  derived  from  this  analysis  has  to  do  with  the 
continued  importance  of  the  FARC  secretariat.  The  terrorist  organization  is  highly 
sensitive  to  anything  that  happens  to  one  of  its  members  at  this  level.  Therefore, 
it  is  important  to  assess  the  current  strategies  to  neutralize  these  actors, 
including  new  perspectives  of  action,  such  as  the  prosecution  of  their  personal 
finances  and  their  criminal  alliances.  This  research  has  highlighted  their 
accessibility  to  the  details  of  operations  conducted  by  criminal  organizations  on 
their  behalf.  Therefore,  it  is  necessary  to  deploy  further  capabilities  in 
psychological  and  deception  operations  to  disturb  their  judgment  during  their 
decision-making  process.  The  fact  that  most  leaders  are  separated  from  daily 
operations  (as  in  the  previous  examples)  and  have  to  make  decisions  from 
faraway  geographic  locations  lends  itself  to  these  types  of  operations. 
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A  third  strategy  derived  from  this  analysis  could  focus  on  the  state’s 
capabilities  for  preventing  the  formation  of  new  alliances  with  criminal  groups. 
One  approach  would  be  to  motivate  and  accelerate  the  demobilization  process  of 
combatants  before  the  peace  process  concludes.  This  would  help  improve 
understanding  of  the  FARC’s  structural  composition,  which  would  help  predict 
potential  risks  to  the  security.  A  complementary  approach  would  be  to  pay  more 
attention  to  vulnerable  population.  The  state  must  create  plans  to  deploy  its 
agencies  to  identify  geographical  areas  in  risk.  It  should  prioritize  the  assessment 
of  the  younger  population  that  could  follow  the  line  of  criminal  inheritance  that  in 
the  near  future  allows  them  to  become  the  new  warlords  in  Colombia. 

A  final  strategy  could  focus  on  discouraging  criminal  organizations  from 
serving  the  FARC’s  purposes.  It  is,  in  fact,  a  gigantic  task  for  Colombian 
authorities  to  identify  criminal  groups  willing  to  associate  with  terrorists. 
Consequently,  the  authorities  could  take  at  least  two  approaches  to  deal  with  this 
dilemma.  The  first  one  is  for  the  authorities  to  work  on  developing  a  cohesive 
narrative  toward  populations  affected  with  high-crime  rates.  This  approach  could 
lead  to  better  relationships  with  these  populations  who  could  provide  the 
authorities  with  important  information  about  criminal  networks  and  their  potential 
affections  toward  the  FARC.  A  second  approach  would  be  to  develop 
psychological  campaigns  across  criminal  organizations’  territories.  The  goal  of 
these  campaigns  would  be  to  create  distrust  between  the  FARC  and  various 
criminal  organizations. 

The  historical  context  and  social  network  analyses  used  here  have  shed 
light  on  the  type  of  networks  that  create  risks  to  Colombia’s  security  in  the  near 
future.  It  is  clear  that  criminality  in  the  country  has  already  shifted  to  a  more 
sophisticated  context  in  which  terrorist  or  criminal  ideologies  couple  with  the 
objective  of  confronting  the  state.  The  FARC’s  method  of  subcontracting  out 


"'30  Carlos  Andres  Prieto,  “Las  BACRIM  y  El  Crimen  Organizado  en  Colombia”  [The 
BACRIM  and  organized  crime  in  Colombia],  Friedrich  Ebert  Stiftung  FES  Poiicy  Paper  47  (March 
2013),  13. 
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violence  is  the  newest  sign  demonstrating  this  shift  that  will  challenge  the  state  in 
the  near  future  and  its  goal  to  provide  security  throughout  the  country. 
Consequently,  this  research  provided  the  first  step  in  analyzing  a  phenomenon 
that  must  be  fully  understood  in  order  for  the  state  to  develop  practical 
alternatives  to  develop  and  maintain  peace  in  a  post-conflict  Colombia. 
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APPENDIX  1.  ISAIAS  DUARTE  CASE  STUDY 


A.  LIST  OF  OPEN  SOURCES 


Source 

Title  (in  original 
language) 

Date 

Internet  link 

El  Tiempo 

Sicario  salio  72  boras 
de  carcel  para  matar  a 
monsenor  Duarte 
[Murderer  left  jail  72 
hours  to  kill  Monsignor 
Duarte] 

February 

1 , 2002 

http://www.eltiempo.com/archivo/ 
documento/MAM-51 60703 

La  Vanguardia 

Detienen  al  jefe  de  una 
banda  de  sicarios  por  el 
asesinato  del  arzobispo 
de  Cali  [Arrested  chief 
of  a  killers’  gang 
charged  for  the  killing  of 
Cali’s  Archbishop] 

March  26, 
2002 

http://www.lavanguardia.com/ 

internacional/20020326/ 

51 2627521 48/detienen-al-jefe-de- 
una-banda-de-sicarios-por-el- 
asesinato-del-arzobispo-de- 
cali.htm  l#ixzz38KjFFXDm 

El  Tiempo 

Asesinado  presunto 
sicario  de  Duarte  C. 
[Killed  hitman  presumed 
assassin  of  Duarte] 

May  31, 
2002 

http://www.eltiempo.com/archivo/ 
docu  mento-20 1 3/MAM-1 309855 

El  Tiempo 

El  Asesinato  de 
monsenor  [The  killing  of 
monsignor] 

June  1 1 , 
2002 

http://www.eltiempo.com/archivo/ 
documento-201 3/MAM-1 369853 

El  Tiempo 

Exterminio  en  caso 
Duarte  C. 

[Extermination  in  Duarte 
C.’s  case] 

October 

11, 2002 

http://www.eltiempo.com/archivo/ 
documento/MAM-1 375247 

Colombia.com 

Capturado  “esiabon”  en 
crimen  de  monsenor 
Duarte  Cancino 
[Arrested  “link”  in  crime 
of  Monsignor  Duarte] 

November 

6, 2002 

http://www.colombia.com/noticias/ 
autonoticias/2002/ 
DetalleNoticial  6401  .asp 

El  Tiempo 

Murio  de  un  infarto 
cofundadorde  FARC 
[FARC’s  cofounder  died 
from  a  heart  attack] 

December 
13,  2003 

http://www.eltiempo.com/archivo/ 
documento/MAM-1 04901 9 

El  Pais 

72  ahos  de  carcel  para 
asesinos  de  Arzobispo 
[72  years  of  prison  for 
killers  of  Archbishop] 

January 

19,  2005 

http://historico.elpais.com.co/ 
paisonline/notas/Enerol  92005/ 
D419N1.html 
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List  of  Open  Sources  (continued) 


Source 


El  tiempo 


El  tiempo 


General 

attorney 

office 


El  pais 


Colombia 

reports 


El  tiempo 


El 

colombiano 


Semana 


Title  (in  original 
language) 

Date 

Internet  link 

Absuelven  a  uno  de  los 
acusados  por  la  muerte 
de  monsenor  isaias 
duarte  cancino 
[absolved  one  of  the 
accused  for  the  death  of 

October 

26,  2006 

Http://www.eltlempo.com/archivo/ 

documento/cms-3300998 

monsignor] 

Dictan  aseguramiento 
contra  10  presuntos 
miembros  de  la  banda 

‘el  grande’  o  ‘el  alto’ 
[ordered  security 
measure  against  10 
members  of  gang  el 
grande] 

December 

1, 2008 

Http://www. eltiempo.com/archivo/ 
documento/cms-4698920 

Fallo  condenatorio 
contra  miembros  de  la 

December 

4, 2009 

Http://www.fiscalia.gov.co/colombia/ 

banda  ‘el  grande’ 

noticias/fallo-condenatorio-contra- 

[conviction  against 
members  of  el  grande] 

miembros-de-la-banda-el-grande/ 

Asesinan  a  hombre  que 
fue  investigado  por  la 
muerte  de  isaias  duarte 
cancino  [a  man  killed 
who  was  investigated  for 
the  death  of  isaias 

May  30, 
2011 

Http://www.elpais.com.co/elpais/ 

judicial/asesinado-hombre- 

implicado-en-muerte-arzobispo-cali- 

isaias-duarte-cancino 

duarte] 

Mafioso  fare  boss 
‘mincho’  killed  in 

October 

20, 2011 

Http://colombiareports.co/mafioso- 

farc-leader-mincho-killed-in- 

bombing  raid 

bombing-raid/ 

Se  cae  fallo  contra  las 

fare  por  crimen  de 
monsenor  duarte 

March  27, 

Http://www.eltiempo.com/archivo/ 

[conviction  of  the  fare 
fails  regarding  crime  on 
monsignor] 

2013 

documento/cms-1 27 1 3324 

Piden  incluir  testimonio 
en  caso  de  monsenor 
isaias  duarte  cancino 

March  31, 

Http  ://m. elcolombiano.com/article/ 

[they  request  to  include 
testimony  in  duarte’s 
case] 

2013 

134691 

Caso  de  monsenor 
duarte,  jque  fallo! 
[monsignor  duarte  case, 
what  a  failure!] 

April  6, 
2013 

Http://www. semana.com/nacion/ 
articulo/caso-monsenor-duarte-que- 
fallo/339025-3 
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B.  TIMELINE 


Date 

Type  of  event 

Description 

Timeframe 

3/16/2002 

Assassination 

Archbishop  Isaias  Duarte-Cancino  killed  in  Cali 
city  by  two  murderers 

1 

Criminal  contact  1  and  2  were  arrested  by 

3/26/2002 

Military  operation 

military  units.  They  were  allegedly  participating 
as  contacts  of  the  Archbishop  Duarte’s 
murderers.  They  were  released  later. 

1 

4/10/2002 

Law  enforcement 
operation 

National  Police  arrested  Hitman  1  and  2.  They 
were  accused  of  killing  the  Archbishop. 

2 

5/30/2002 

Killing 

Hitman  1  was  murdered  inside  a  penitentiary  in 
Cali  city. 

2 

6/8/2002 

Law  enforcement 
operation 

National  Police  arrested  JFJ-FCCO,  allegedly  a 
FARC  contact  with  the  murderers 

2 

Criminal  contact  1  was  killed.  He  was  captured 

7/2/2002 

Killing 

by  military  units  allegedly  for  being  a  contact  of 
the  murderers 

3 

Criminal  contact  2  was  killed.  He  was  captured 

10/9/2002 

Killing 

by  military  units  allegedly  for  being  a  contact  of 
the  murderers 

4 

Secretariat  3  dies  from  natural  causes.  This 

12/13/ 

Death 

former  FARC  leader  was  allegedly  one  of  the 

8 

2003 

terrorists  who  order  the  assassination  of  the 
archbishop 

1/18/2005 

Judicial  Sentence 

JFJ-FCCO  is  found  guilty  for  the  murder  of 
Archbishop  Duarte. 

13 

JFJ-FCCO  is  released  after  a  Criminal  Court 

10/1/2006 

Judicial  Sentence 

examined  the  testimony  related  to  his 
participation  in  the  crime. 

20 

11/27/ 

Law  enforcement 

Members  of  the  criminal  organization  El  Grande 
were  arrested  in  Cali  City  for  their  involvement 

28 

2008 

operation 

in  different  crimes.  Among  the  arrested  is  JFJ- 
FCCO 

12/4/2009 

Judicial  Sentence 

Members  of  the  criminal  organization  El  Grande 
were  sentenced  to  prison  for  their  involvement 
in  different  crimes.  Among  the  convicted  is  JFJ- 
FCCO 

32 

5/28/2011 

Killing 

JFJ-FCCO  was  murdered  in  rural  area  30 
kilometers  southern  Cali-Colombia 

38 

10/20/ 

2011 

Military  operation 

JNUV-FCCO  was  KIA  during  a  military 
operation.  This  former  FARC  leader  was 
allegedly  one  of  the  terrorists  who  order  the 
assassination  of  the  bishop 

40 

11/4/2011 

Military  operation 

Secretariat  2  was  KIA  during  a  military 
operation.  This  former  FARC  leader  was 
allegedly  one  of  the  terrorists  who  ordered  the 
assassination  of  the  bishop 

40 
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C.  CENTRALITY  MEASURES  OVER  TIME 


TOP  10  X  TIME 

Time  1-2 

-  Net.  Size  11 

degree 

score 

eigenvector 

score 

Between. 

score 

closeness 

score 

PC-FCCO 

7 

PC-FCCO 

69.832 

PC-FCCO 

60.00 

PC-FCCO 

85.00 

Hitman  1 

4 

Secretariat  1 

56.996  Criminal  contact  1 

11.85 

Secretariat  4 

65.00 

Secretariat 

1 

4 

Secretariat  3 

56.996  Criminal  contact  2 

11.85 

Secretariat  1 

65.00 

Secretariat 

2 

4 

Secretariat  2 

56.996 

JNUV-FCCO 

11.11 

Secretariat  2 

65.00 

Secretariat 

3 

4 

Secretariat  4 

56.996 

Hitman  1 

8.15 

Secretariat  3 

65.00 

Secretariat 

4 

4 

criminal  contact  1  24.272 

JFJ-FCCO 

2.96 

criminal 
contact  1 

65.00 

criminal 
contact  1 

3 

criminal  contact  2  24.272 

Hitman  2 

0.74 

criminal 
contact  2 

65.00 

Hitman  2 

3 

JNUV-FCCO 

18.527 

Secretariat  1 

0.00 

Hitman  1 

63.33 

criminal 
contact  2 

3 

Hitman  1 

17.17 

Secretariat  2 

0.00 

JNUV-FCCO 

58.33 

JFJ-FCCO 

2 

Hitman  2 

15.553 

Secretariat  3 

0.00 

Hitman  2 

56.67 

Time  3  Net.  Size  9 

degree 

score 

eigenvector 

score 

Between. 

score 

closeness 

score 

PC-FCCO 

7 

PC-FCCO 

69.616 

PC-FCCO 

75 

PC-FCCO 

93.75 

Secretariat 

4 

4 

Secretariat  1 

59.713 

JNUV-FCCO 

25 

Secretariat  4 

72.917 

Secretariat 

3 

4 

Secretariat  3 

59.713  Criminal  contact  2 

0 

Secretariat  2 

72.917 

Secretariat 

1 

4 

Secretariat  2 

59.713 

Secretariat  3 

0 

Secretariat  1 

72.917 

Secretariat 

2 

4 

Secretariat  4 

59.71 

Criminal  contact  1 

0 

Secretariat  3 

72.917 

JNUV- 

FCCO 

2 

JNUV-FCCO 

17.733 

Secretariat  1 

0 

JNUV-FCCO 

62.5 

Criminal 
contact  2 

1 

criminal  contact  1 

16.711 

JFJ-FCCO 

0 

Criminal 
contact  2 

54.167 

JFJ-FCCO 

1 

criminal  contact  2  16.711 

Secretariat  2 

0 

Criminal 
contact  1 

54.167 

Criminal 
contact  1 

1 

JFJ-FCCO 

4.257 

Secretariat  4 

0 

JFJ-FCCO 

43.75 
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Centrality  Measures  over  Time  (continued) 


Time  4  Net.  Size  8 


degree 

score 

eigenvector 

score 

Between. 

score 

closeness  score 

PC-FCCO 

6 

PC-FCCO 

67.554 

PC-FCCO 

66.667 

PC-FCCO  92.857 

Secretariat 

4 

4 

Secretariat  1 

60.915 

JNUV-FCCO 

28.571  Secretariat  4  76.19 

Secretariat 

3 

4 

Secretariat  3 

60.915 

Secretariat  3 

0 

Secretariat  2  76.19 

Secretariat 

1 

4 

Secretariat  2 

60.915 

Criminal  contact 
2 

0 

Secretariat  1  76.19 

Secretariat 

2 

4 

Secretariat  4 

60.915 

Secretariat  1 

0 

Secretariat  3  76.19 

JNUV- 

FCCO 

2 

JNUV-FCCO 

17.476 

JFJ-FCCO 

0 

JNUV-FCCO  64.286 

Criminal 
contact  2 

1 

criminal  contact 
2 

16.441 

Secretariat  2 

0 

54.762 

contact  2 

JFJ-FCCO 

1 

JFJ-FCCO 

4.253 

Secretariat  4 

0 

JFJ-FCCO  45.238 

Time  5-9  Net.  Size  7 

degree 

score 

eigenvector 

score 

Between. 

score 

closeness  score 

PC-FCCO 

5 

PC-FCCO 

65.454 

PC-FCCO 

53.333 

PC-FCCO  91.667 

Secretariat 

3 

4 

Secretariat  1 

62.053 

JNUV-FCCO 

33.333  Secretariat  3  80.556 

Secretariat 

2 

4 

Secretariat  3 

62.053 

Secretariat  3 

0 

Secretariat  2  80.556 

Secretariat 

1 

4 

Secretariat  2 

62.053 

Secretariat  1 

0 

Secretariat  1  80.556 

Secretariat 

4 

4 

Secretariat  4 

62.053 

JFJ-FCCO 

0 

Secretariat  4  80.556 

JNUV- 

FCCO 

2 

JNUV-FCCO 

17.188 

Secretariat  2 

0 

JNUV-FCCO  66.667 

JFJ-FCCO 

1 

JFJ-FCCO 

4.239 

Secretariat  4 

0 

JFJ-FCCO  47.222 

85 


Centrality  Measures  over  Time  (continued) 


Time  10-19  Net.  Size  6 


degree 

score 

eigenvector 

score  Between. 

score 

closeness 

score 

PC-FCCO 

4 

PC-FCCO 

74. 138  PC-FCCO 

60 

PC-FCCO 

90 

Secretariat 

o 

1 

O 

Secretariat  1 

67.613JNUV-FCCO 

40 

Secretariat  1 

76.667 

Secretariat 

Q 

2 

O 

Secretariat  2 

67.61 3  Secretariat  1 

0 

Secretariat  2 

76.667 

Secretariat 

O 

4 

o 

Secretariat  4 

67.613JFJ-FCCO 

0 

Secretariat  4 

76.667 

JNUV- 

o 

FCCO 

JNUV-FCCO 

26.73  Secretariat  2 

0 

JNUV-FCCO 

70 

JFJ-FCCO 

1 

JFJ-FCCO 

8.632  Secretariat  4 

0 

JFJ-FCCO 

50 

Time  20-28  Net.  Size  16 

degree 

score 

eigenvector 

score  Between. 

score 

closeness 

score 

JFJ-FCCO 

11 

JFJ-FCCO 

44.248JFJ-FCCO 

47.857JFJ-FCCO 

83.333 

El  Grande 

10 

1 

El  Grande  3 

43.816JNUV-FCCO 

41.905EI  Grande  1 

77.222 

El  Grande 

10 

2 

El  Grande  2 

43.81 6  PC-FCCO 

34.286  El  Grande  2 

77.222 

El  Grande 

10 

3 

El  Grande  5 

43.816EI  Grande  1 

0.238  El  Grande  3 

77.222 

El  Grande 

10 

4 

El  Grande  1 

43.816EI  Grande  2 

0.238  El  Grande  4 

77.222 

El  Grande 

10 

5 

El  Grande  4 

43.816EI  Grande  5 

0.238  El  Grande  5 

77.222 

El  Grande 

10 

6 

El  Grande  7 

43.816EI  Grande  4 

0.238  El  Grande  6 

77.222 

El  Grande 

10 

7 

El  Grande  6 

43.816EI  Grande  3 

0.238  El  Grande  7 

77.222 

El  Grande 

Q 

8 

y 

El  Grande  9 

40.422  El  Grande  7 

0.238  El  Grande  8 

73.889 

El  Grande 

Q 

9 

y 

El  Grande  8 

40.422  El  Grande  6 

0.238  El  Grande  9 

73.889 

Time  29-38  Net.  Size  6 

degree 

score 

eigenvector 

score  Between. 

score 

closeness 

score 

PC-FCCO 

4 

PC-FCCO 

74. 138  PC-FCCO 

60 

PC-FCCO 

90 

Secretariat 

Q 

1 

O 

Secretariat  1 

67.613JNUV-FCCO 

40 

Secretariat  1 

76.667 

Secretariat 

O 

2 

o 

Secretariat  2 

67.61 3  Secretariat  1 

0 

Secretariat  2 

76.667 

Secretariat 

Q 

4 

O 

Secretariat  4 

67.613JFJ-FCCO 

0 

Secretariat  4 

76.667 

JNUV- 

o 

FCCO 

JNUV-FCCO 

26.73  Secretariat  2 

0 

JNUV-FCCO 

70 

JFJ-FCCO 

1 

JFJ-FCCO 

8.632  Secretariat  4 

0 

JFJ-FCCO 

50 
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Centrality  Measures  over  Time  (continued) 


Time  39-40  Net.  Size  5 


degree 

score 

eigenvector 

score  Between. 

score 

closeness 

score 

PC-FCCO 

4 

PC-FCCO 

74.043  PC-FCCO 

50 

PC-FCCO 

100 

Secretariat 

Q 

2 

O 

Secretariat  1 

68.171JNUV-FCCO 

0 

Secretariat  2 

87.5 

Secretariat 

O 

1 

o 

Secretariat  2 

68.171  Secretariat  1 

0 

Secretariat  1 

87.5 

Secretariat 

Q 

4 

O 

Secretariat  4 

68.171  Secretariat  2 

0 

Secretariat  4 

87.5 

JNUV- 

FCCO 

1 

JNUV-FCCO 

23.992  Secretariat  4 

0 

JNUV-FCCO 

62.5 

Time  41  Net.  Size  3 

degree 

score 

eigenvector 

score  Between. 

score 

closeness 

score 

Secretariat 

o 

1 

Z 

Secretariat  1 

81.65  Secretariat  1 

0 

Secretariat  1 

100.00 

PC-FCCO 

2 

PC-FCCO 

81.65  PC-FCCO 

0 

PC-FCCO 

100.00 

Secretariat 

o 

4 

Z 

Secretariat  4 

81.65  Secretariat  4 

0 

Secretariat  4 

100.00 
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D. 


TOPOGRAPHICAL  MEASURES  AND  CENTRALIZATION 


Time  n=quarter  ==>41 

Time 

1-2 

Time 

3 

Time 

4 

size 

11 

size 

9 

size 

8 

Avg.  degree 

3.6 

Avg.  degree 

3.1 

Avg.  degree 

3.2 

Density 

0.36 

Density 

0.38 

Density 

0.46 

Degree  centraiization  (%) 

37.00 

Degree  centraiization 

62.50 

Degree  centraiization 

52.38 

Degree  standard  deviation 

1.30 

Degree  standard  deviation 

1.91 

Degree  standard  deviation 

1.64 

Eigenvector  centraiization  {%) 

52.96 

percent 

Eigenvector  centraiization 

50.79 

percent 

Eigenvector  centraiization 

43.88 

Eigenvector  standard  deviation  (norm.) 

21.34 

Eigenvector  standard  deviation  (norm.) 

24.24 

Eigenvector  standard  deviation  (norm.) 

24.35 

Betweenness  centraiization  (%) 

55.33 

Betweenness  centraiization 

71.88 

Betweenness  centraiization 

62.59 

Betweenness  standard  deviation  (norm.) 

16.64 

Betweenness  standard  deviation  (norm.) 

23.90 

Betweenness  standard  deviation  (norm.) 

22.71 

Cioseness  centraiization  {%) 

48.20 

Cioseness  centraiization 

65.29 

Cioseness  centraiization 

56.01 

Cioseness  standard  deviation  (norm.) 

7.67 

Cioseness  standard  deviation  (norm.) 

13.92 

Cioseness  standard  deviation  (norm.) 

13.93 

Ciustering  Coefficient  (wtd) 

0.58 

Ciustering  Coefficient 

0.65 

Ciustering  Coefficient 

0.75 

Time 

5-9 

Time 

10-19 

Time 

20-28 

size 

7 

size 

6 

size 

16 

Avg.  degree 

3.4 

Avg.  degree 

2.6 

Avg.  degree 

7.6 

Density 

0.57 

Density 

0.53 

Density 

0.50 

Degree  centraiization  (%) 

36.67 

Degree  centraiization 

40.00 

Degree  centraiization 

25.71 

Degree  standard  deviation 

1.29 

Degree  standard  deviation 

0.94 

Degree  standard  deviation 

3.20 

Eigenvector  centraiization  (%) 

34.67  t 

Eigenvector  centraiization 

47.93 

Eigenvector  centraiization 

21.08 

Eigenvector  standard  deviation  (norm.) 

23.78 

Eigenvector  standard  deviation  (norm.) 

24.97 

Eigenvector  standard  deviation  (norm.) 

19.36 

Betweenness  centraiization  (%) 

47.78 

Betweenness  centraiization 

52.00 

Betweenness  centraiization 

42.67 

Betweenness  standard  deviation  (norm.) 

20.29 

Betweenness  standard  deviation  (norm.) 

24.27 

Betweenness  standard  deviation  (norm.) 

16.27 

Cioseness  centraiization  {%) 

41.76 

Cioseness  centraiization 

45.00 

Cioseness  centraiization 

35.29 

Cioseness  standard  deviation  (norm.) 

13.32 

Cioseness  standard  deviation  (norm.) 

12.02 

Cioseness  standard  deviation  (norm.) 

14.30 

Ciustering  Coefficient  (wtd) 

0.86 

Ciustering  Coefficient 

0.75 

Ciustering  Coefficient 

0.94 
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Topographical  Measures  and  Centralization  (continued) 


Time 

29-38 

Time 

39-40 

Time 

41 

size 

6 

size 

5 

size 

3 

Avg.  degree 

2.6 

Avg.  degree 

2.8 

Avg.  degree 

2.0 

Density 

0.53 

Density 

0.70 

Density 

1.00 

Degree  centraiization  (%) 

40.00 

Degree  centraiization 

50.00 

Degree  centraiization 

0.00  t 

Degree  standard  deviation 

0.94 

Degree  standard  deviation 

0.07 

Degree  standard  deviation 

0.00 

Eigenvector  centraiization  {%) 

47.93 

Eigenvector  centraiization 

33.83 

Eigenvector  centraiization 

0.00 

Eigenvector  standard  deviation  (norm.) 

24.97 

Eigenvector  standard  deviation  (norm.) 

18.40 

Eigenvector  standard  deviation  (norm.) 

0.00 

Betweenness  centraiization  {%) 

52.00 

Betweenness  centraiization 

50.00 

Betweenness  centraiization 

0.00 

Betweenness  standard  deviation  (norm.) 

24.27 

Betweenness  standard  deviation  (norm.) 

20.00 

Betweenness  standard  deviation  (norm.) 

0.00 

Cioseness  centraiization  (%) 

45.00 

Cioseness  centraiization 

43.75 

Cioseness  centraiization 

0.00 

Cioseness  standard  deviation  (norm.) 

12.02 

Cioseness  standard  deviation  (norm.) 

12.25 

Cioseness  standard  deviation  (norm.) 

0.00 

Ciustering  Coefficient  (wtd) 

0.75 

Ciustering  Coefficient 

0.80 

Ciustering  Coefficient 

1.00 
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E.  NETWORK  TRANSFORMATION  OVER  TIME 
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F.  SOCIAL  NETWORK  CHANGE  DETECTION 


Betweenness  network  centralization  -  Change  Detection 


TltwfKtw 


Decrease  — Increase 


Eigenvector  network  centralization 


— Decrease  — Increase 


owl 
0  7%{ 
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Closeness  network  centralization 


— Decrease  — Increase 

Degree  network  centralization 


IS  W  M 


Social  Network  Change  Detection  (continued) 


Clu«t«rlng  Co*mci«nt  •  Chang*  0«t*cUon 
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APPENDIX  2.  EL  NOGAL  CASE  STUDY 


A.  LIST  OF  OPEN  SOURCES 


Source 

Title  (in  original 
language) 

Date 

Internet  link 

Semana 

<i,Quien  puso  la  bomba 
en  el  Club  El  Nogal? 
[Who  placed  the  lED  in 
El  Nogal?] 

Februar 
y  16, 
2003 

http://www.semana.com/nacion/ 

articulo/quien-puso-bomba-club- 

el-nogal/56489-3 

El  Tiempo 

A  Arellan  le  dijeron  que 
El  Nogal  volaba  a  las 

10  p.m.  [Arellan  was 
told  the  El  Nogal 

Februar 

y27, 

2003 

http://www.eltiempo.com/archivo/ 
documento-20 1 3/MAM-984494 

exploded  at  10  p.m] 

Las  Fare  preparaban 
atentado  contra  el 

http://www.semana.com/noticias/ 

Semana 

Hospital  Militar  [The 
FARC  planned  an 
attack  on  the  Military 
Hospital] 

April  13, 
2003 

articulo/las-farc-preparaban- 

atentado-contra-hospital-militar/ 

57615-3 

Habria  muerto  “El 
Mocho”  de  FARC  y 

http://www.caracol.com.co/ 

Caracol 

diez  de  sus 
comandados  [“El 

October 
20,  2003 

noticias/judiciales/habria-muerto- 

el-mocho-de-farc-y-diez-de-sus- 

Mocho”  from  the  FARC 

comandados/20031 020/nota/ 

is  dead  with  10  of  his 

85435. aspx 

men] 

Secretariado  ordeno 

Decemb 
er  18, 
2003 

El  Tiempo 

contra  El  Nogal  [The 
Secretariat  ordered 

http://www.eltiempo.com/archivo/ 

documento/MAM-1049213 

against  El  Nogal] 

Fiscalia  esclarece  el 
atentado  a  El  Nogal 

Decemb 

http://historico.elpais.com.co/ 

El  Pais 

[Attorney  General 
clarifies  attack  on  El 

er  18, 
2003 

paisonline/notas/ 
Diciembrel  82003/A61 8N4.html 

Nogal] 

El  Tiempo 

Las  piezas  secretas  de 
El  Nogal  [The  secret 
pieces  of  El  Nogal] 

Decemb 

er21, 

2003 

http://www.eltiempo.com/archivo/ 
documento/MAM-1 04686 

El  Tiempo 

Aguja  ,  el  reclutador 
del  atentado  al  club  El 
Nogal  [Aguja,  the 
recruiter  for  the  attack 

June  13, 
2005 

http://www.eltiempo.com/archivo/ 
documento/MAM-1 956252 

on  El  Nogal] 
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List  of  Open  Sources  (continued) 


Source 

Title  (in  original 
language) 

Date 

Internet  link 

El 

Colombiano 

Fernando  Arellan  Ira  a 
juicio  por  atentado  a 
Club  El  Nogal 
[Fernando  Arellan  goes 
to  trial  for  attack  on  El 
Nogal] 

Novemb 
er  14, 
2005 

http://www.elcolombiano.com/ 
BancoConocimiento/ 
0/olac_arellanJraJuicio_colpren 
sa_ana_20051114/ 
olac_arellanJraJuicio_colprensa 
ana  20051 114.asp 

El  Pais 

Se  inicia  el  juicio  por 
ataque  al  Club  El 
Nogal  [Trial  for  attack 
on  El  Nogal  begins] 

Novemb 
er  15, 
2005 

http://historico.elpais.com.co/ 
paisonline/notas/ 
Noviembre152005/A515N1  .html 

Colombian 
Air  Force 
press 

La  guerrilla  de  las  Fare 
tenia  planeado  atentar 
contra  el  Hospital 
Militar,  en  Bogota  [The 
FARC  had  planned  to 
attack  the  Military 
Hospital  in  Bogota] 

Decemb 
er  2, 
2005 

https://www.fac.mil.co/7idcategori 

a=5619 

Caracol 

Capturada  la  mujer  que 
presuntamente 
suministro  los 
explosivos  para  el 
atentado  al  Nogal 
[Woman  arrested  that 
provided  explosives 
used  in  the  attack  on  El 
Nogal] 

March 

13,2007 

http://www.caracol.com.co/ 
noticias/judiciales/capturada-la- 
mujer-que-presuntamente- 
suministro-los-explosivos-para-el- 
atentado-al-nogal/2007031 3/ 
nota/401828.aspx 

El 

Espectador 

Capturan  a 
responsable  de 
atentado  a  El  Nogal 
[Arrested  one 
responsible  of  attack 
on  El  Nogal] 

October 
30,  2008 

HTTP://WWW.ELESPECTADOR. 

COM/NOTICIAS/JUDICIAL/ 

ARTICUL086978-CAPTURAN- 

RESPONSABLE-DE- 

ATENTADO-EL-NOGAL 

Condenan  a  40  ahos 

El 

Espectador 

de  prision  a 
responsables  de 
atentado  en  club  El 
Nogal  [40  year  prison 
sentence  to  those 
responsible  of  attack 
on  El  Nogal] 

Decemb 
er  1, 
2008 

http://www.elespectador.com/ 
noticias/judicial/articulo951 51  - 
condenan-40-anos-de-prision- 
responsables-de-atentado-club- 
el-nogal 
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List  of  Open  Sources  (continued) 


Source 

Title  (in  original 
language) 

Date 

Internet  link 

El 

Espectador 

Autor  de  atentado  al 
Nogal  estara  40  anos 
en  la  carcel 
[Perpetrator  of  attack 
on  El  Nogal  will  serve 
40  years  of  prison] 

January 

26,  2009 

http://www.elespectador.com/ 
noticias/judicial/articulol  11761- 
autor-de-atentado-al-nogal-estara- 
40-anos-carcel 

El 

Espectador 

Capturan  a  hermanos 
presuntamente 
implicados  en  atentado 
a  ‘El  Nogal’  [Arrested 
brothers  allegedly 
involved  in  attack  on  El 
Nogal] 

August  28, 
2009 

http://www.elespectador.com/ 
noticias/judicial/articulol  58434- 
capturan-hermanos- 
presuntamente-implicados- 
atentado-el-nogal 

El 

Espectador 

Condenan  a  40  ahos  a 
guerrillero  que 
participo  en  atentado  a 
‘El  Nogal’  [Conviction 
of  40  years  to  terrorist 
involved  in  attack  on  El 
Nogal] 

September 

1 1 , 2009 

http://www.elespectador.com/ 
noticias/judicial/articulol  60823- 
condenan-40-anos-guerrillero- 
participo-atentado-el-nogal 

El 

Espectador 

Correos  del  ‘Mono 
Jojoy’  revelan  como  se 
planed  atentado  contra 
El  Nogal  [Emails  from 
‘Mono  Jojoy’  reveal 
how  the  attack  on  El 
Nogal  was  planned] 

October 

16,  2010 

http://www.elespectador.com/ 

noticias/judicial/correos-del-mono- 

jojoy-revelan-se-planeo-atentado- 

contr-articulo-230048 
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List  of  Open  Sources  (continued) 


El 

Espectador 


El 

Espectador 


Supreme 

Criminal 

Court 


El  Tiempo 


W  radio 


Capturan  autor 
del  atentado  al 
club  El  Nogal 
[Perpetrator 
arrested  for 
attack  on  El 
Nogal] 
Pagara  una 
condena  de  40 
anos  de  prision 
el  terrorista  de  El 
Nogal  [Terrorist 
of  El  Nogal  will 
serve  40  years 
of  prison] 


March  5, 
2011 


March  6, 
2011 


Negacion  de 

casacion  [Denial  9019  ’ 
of  appeal] 


Los 

computadores 
de  las  FARC 
dieron  la  clave 
[The  FARC 
computers  were 
the  key] 

Los  lideres  de 
las  Fare  que 
permanecen  en 
Colombia  [The 
FARC  leaders 
remaining  in 
Colombia] 


February 
2,  2013 


February 
28,  2014 


http://www.elespectador.com/noticias/ 

judicial/capturan-autor-del-atentado-al- 

club-el-nogal-articulo-255039 


http://www.elespectador.com/noticias/ 

judicial/el-terrorista-de-el-nogal-articulo- 


255159 


http://www.usergioarboleda.edu.co/ 
derecho_penal/jurisprudencia_2012/ 
jurisprudencia_segunclo_trimestre_2012/ 
36123(1 1-04-12).pdf 


http://www.eltiempo.com/Multimedia/ 
especiales/atentado/el/nogal/los- 
computadores-de-las-farc-dieron-la- 
clave  12574121-7 


http://www.wradio.com.co/noticias/ 
actualidad/los-lideres-de-las-farc-que- 
permanecen-en-colombia/20140228/nota/ 
21 05792. aspx 
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B.  TIMELINE 


Date 

Type  of  event 

Description 

Timefra 

me 

11/30/ 

2002 

Logistics 

Acquisition  of  the  workshop  to  load 
vehicle  with  explosives 

1 

12/2/2002 

Logistics 

CMTF  provides  explosives  to  the  terrorist 
organization 

1 

12/3/2002 

Logistics 

Explosive  transported  to  Bogota  on  a 
“chiva  rumbera”  (party  bus) 

1 

12/9/2002 

Logistics 

Logistic  members  of  the  FARC  got 
involved  in  conditioning  the  car  bomb 

1 

1/31/2003 

Logistics 

Terrorists  bought  a  Chevrolet  Megan  used 
as  car  bomb.  They  paid  in  cash. 

1 

1/31/2003 

Meeting 

Meeting  between  AMB,  the  criminal 
organization,  DAPPAand  WDR 

1 

2/6/2003 

Logistics 

Car  is  loaded  with  explosives. 

1 

2/6/2003 

Meeting 

FARC  members  decided  to  kill  members 
of  the  criminal  gang. 

1 

2/7/2003 

Terrorist  attack 

Execution  of  the  terrorist  attack  on  El 
Nogal  Club 

2 

4/4/2003 

Law  enforcement  Arrested  members  of  the  terrorist  network 

9 

operation  (L.E.O) 

-AMB  and  FGRG 

8/30/2003 

Investigation 

Member  of  CMTF  defects  and  becomes 
witness 

4 

10/19/ 

2003 

Military  operation 

KIA  member  of  the  FARC’s  CMTF 

4 

11/1/2003 

Death 

Death  of  a  FARC  leader 

5 

12/20/ 

2003 

(L.E.O) 

Arrested  FARC  member  in  Bogota 

5 

5/1/2004 

(L.E.O) 

Arrested  members  of  the  terrorist  network 

7 

9/30/2005 

(L.E.O) 

Member  of  the  criminal  gang  arrested 

12 

3/12/2007 

(L.E.O) 

Arrested  members  of  the  terrorist  network 

21 

3/1/2008 

(L.E.O) 

KIA  member  of  the  FARC’s  secretariat 

22 

3/26/2008 

Death 

Death  of  the  FARC’s  top  commander 

22 

8/28/2009 

(L.E.O) 

Arrested  personal  contacts  of  VJ W. 
Requested  on  extradition  by  the  U.S. 

28 

9/22/2010 

(L.E.O) 

KIA  member  of  the  FARC’s  secretariat 

32 

3/5/2011 

(L.E.O) 

Arrest  of  a  criminal  gang  member 

34 

11/4/2011 

(L.E.O) 

KIA  member  of  the  FARC’s  secretariat 

37 
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c. 


CENTRALITY  MEASURES  OVER  TIME 


TOP  10  X  TIME 
Time  1-2  -  Net.  Size  27 


degree 

score 

eigenvector 

score 

Between. 

score 

closeness 

HDVSAP 

10 

MJTR-BS 

50.89 

HDVSAP 

54.65 

HDVSAP 

HABAP 

8 

VJSR-BS 

50.891 

VJVV 

22.872 

HABAP 

MJTR-BS 

8 

Secretariat  4 

48.32 

VJSR-BS 

17.53 

WDR  FARC- 
CMTF 
defector 

JFAZ 

8 

Secretariat  3 

48.32 

MJTR-BS 

17.53 

VJSR-BS 

VJSR-BS 

8 

Secretariat  2 

48.32 

HABAP 

15.85 

MJTR-BS 

WDR 

FARC- 

CMTF 

defector 

8 

Secretariat  5 

48.327 

WDR  FARC- 
CMTF 
defector 

10.415 

VJVV 

Secretariat 

1 

7 

Secretariat  1 

48.32 

APAN 

4.154 

JFAZ 

Secretariat 

2 

7 

Secretariat  6 

48.32 

JFAZ 

3.959 

OAB 

Secretariat 

3 

7 

HDVSAP 

20.78 

FGRG 

3.795 

AJALM 

OAB 

7 

WDR  FARC- 
CMTF  defector 

7.577 

LWL 

1.744 

FGRG 

Time  3-4  Net.  Size  19 

degree 

score 

eigenvector 

score 

Between. 

score 

closeness 

HDVSAP 

8 

MJTR-BS 

51.13 

HDVSAP 

65.90 

HDVSAP 

MJTR-BS 

8 

VJSR-BS 

51.13 

VJVV 

29.41 

MJTR-BS 

VJSR-BS 

8 

Secretariat  4 

49.02 

MJTR-BS 

21.56 

VJSR-BS 

Secretariat 

3 

7 

Secretariat  3 

49.02 

VJSR-BS 

21.56 

Secretariat  3 

Secretariat 

5 

7 

Secretariat  2 

49.02 

HABAP 

7.516 

VJVV 

Secretariat 

4 

7 

Secretariat  5 

49.02 

WDR  FARC- 
CMTF 
defector 

4.575 

Secretariat  4 

Secretariat 

6 

7 

Secretariat  1 

49.02 

EGNMM 

0.218 

Secretariat  6 

Secretariat 

1 

7 

Secretariat  6 

49.02 

FAB 

0.218 

Secretariat  1 

Secretariat 

2 

7 

HDVSAP 

17.07 

Secretariat  2 

VJVV 

5 

HABAP 

3.472 

Secretariat  5 

score 

69.231 

61.538 

59.615 


58.974 

58.974 

57.692 


56.41 

53.846 

53.205 

51.923 


score 

72.222 

68.519 

68.519 

58.333 

58.333 

58.333 


58.333 

58.333 

58.333 

58.333 
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Centrality  measures  over  time  (continued) 


Time  5  Net.  Size  17 


degree 

score 

eigenvector 

score 

between. 

score 

closeness 

score 

MJTR-BS 

8 

MJTR-BS 

51.10 

HDVSAP 

51.66 

MJTR-BS 

67.70 

VJSR-BS 

8 

VJSR-BS 

51.10 

VJVV 

30 

VJSR-BS 

67.70 

Secretaria 

t4 

7 

Secretariat  4 

49.18 

MJTR-BS 

20 

HDVSAP 

62.5 

Secretaria 

t3 

7 

Secretariat  3 

49.18 

VJSR-BS 

20 

Secretariat  3 

59.37 

Secretaria 

t2 

7 

Secretariat  2 

49.18 

HABAP 

11.66 

Secretariat  2 

59.37 

Secretaria 

t5 

7 

Secretariat  5 

49.18 

Secretariat  5 

59.37 

Secretaria 

t6 

7 

Secretariat  1 

49.18 

Secretariat  6 

59.37 

Secretaria 

1 1 

7 

Secretariat  6 

49.18 

Secretariat  4 

59.37 

VJVV 

5 

HDVSAP 

15.51 

Secretariat  1 

59.37 

HDVSAP 

5 

VJVV 

2.799 

VJVV 

56.25 

Time  6-7  Net.  Size  15 

degree 

score 

eigenvector 

score 

between. 

score 

closeness 

score 

VJSR-BS 

7 

MJTR-BS 

54.82 

HDVSAP 

46.15 

VJSR-BS 

66.66 

MJTR-BS 

7 

VJSR-BS 

54.82 

VJVV 

32.96 

MJTR-BS 

66.66 

Secretaria 

t5 

6 

Secretariat  4 

52.10 

MJTR-BS 

19.23 

HDVSAP 

60.71 

Secretaria 

t4 

6 

Secretariat  2 

52.10 

VJSR-BS 

19.23 

VJVV 

58.33 

Secretaria 

1 1 

6 

Secretariat  5 

52.10 

HABAP 

13.18 

Secretariat  4 

58.33 

Secretaria 

t6 

6 

Secretariat  1 

52.10 

Secretariat  6 

58.33 

Secretaria 

t2 

6 

Secretariat  6 

52.10 

Secretariat  2 

58.33 

VJVV 

5 

HDVSAP 

19.32 

Secretariat  1 

58.33 

HDVSAP 

4 

VJVV 

4.338 

Secretariat  5 

58.33 

RCR 

acquainte 
d  with 
VJVV 

3 

HABAP 

3.984 

HABAP 

51.19 
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Centrality  measures  over  time  (continued) 


Time  8-12  Net.  Size  14 


degree 

score 

eigenvector 

score 

between. 

score 

cioseness 

score 

MJTR-BS 

7 

MJTR-BS 

54.827 

HDVSAP 

17.949 

MJTR-BS 

60.256 

VJSR-BS 

7 

VJSR-BS 

54.827 

HABAP 

10.256 

VJSR-BS 

60.256 

Secret.4 

6 

Secret.  4 

52.223 

VJSR-BS 

9.615 

Secret. 6 

54.487 

Secret.  1 

6 

Secret.2 

52.223 

MJTR-BS 

9.615 

Secret.  1 

54.487 

Secret.  6 

6 

Secret.5 

52.223 

Secret.  5 

54.487 

Secret.  2 

6 

Secret.  1 

52.223 

Secret.  4 

54.487 

Secret.  5 

6 

Secret.  6 

52.223 

Secret.  2 

54.487 

HDVSAP 

3 

HDVSAP 

18.487 

HDVSAP 

46.154 

RCR 

acquainted 
with  VJVV 

2 

HABAP 

3.115 

HABAP 

35.897 

CACR 

acquainted 
with  VJVV 

2 

FAB 

0.511 

FAB 

26.282 

Time  13-21  Net.  Size  13 

degree 

score 

eigenvector 

score 

between. 

score 

cioseness 

score 

MJTR-BS 

7 

MJTR-BS 

54.827 

HDVSAP 

10.606 

MJTR-BS 

62.5 

VJSR-BS 

7 

VJSR-BS 

54.827 

MJTR-BS 

7.576 

VJSR-BS 

62.5 

Secretariat 

4 

6 

Secretariat  4 

52.225 

VJSR-BS 

7.576 

Secret. 1 

56.944 

Secretariat 

1 

6 

Secretariat  2 

52.225 

Secretariat 

6 

56.944 

Secretariat 

6 

6 

Secretariat  5 

52.225 

Secretariat 

5 

56.944 

Secretariat 

2 

6 

Secretariat  1 

52.225 

Secretariat 

4 

56.944 

Secretariat 

5 

6 

Secretariat  6 

52.225 

Secretariat 

2 

56.944 

HDVSAP 

3 

HDVSAP 

18.474 

HDVSAP 

45.833 

RCR 

acquainted 
with  VJVV 

2 

HABAP 

3.029 

HABAP 

30.556 

CACR 

RCR 

acquainted 

2 

acquainted 

16.667 

with  VJVV 

with  VJVV 
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Centrality  measures  over  time  (continued) 


Time  22  Net.  Size  12 


degree 

score 

eigenvector 

score 

between. 

score 

cioseness 

score 

VJSR-BS 

7 

VJSR-BS 

56.86 

HDVSAP 

12.72 

VJSR-BS 

68.18 

Secret.  1 

6 

Secret.  2 

54.10 

VJSR-BS 

11.27 

MJTR-BS 

63.63 

MJTR- 

BS 

6 

Secret.  5 

54.10 

MJTR-BS 

7.273 

Secret.  1 

62.12 

Secret.  6 

6 

Secret.  1 

54.10 

Secret.  1 

0.364 

Secret.  6 

62.12 

Secret.  2 

6 

Secret.  6 

54.10 

Secret.  6 

0.364 

Secret.  5 

62.12 

Secret.  5 

6 

MJTR-BS 

50.02 

Secret.  2 

0.364 

Secret.  2 

62.12 

Secret.  4 

5 

Secret.  4 

46.79 

Secret.  5 

0.364 

Secret.  4 

57.57 

HDVSAP 

3 

HDVSAP 

18.85 

HDVSAP 

50 

CACR 
acquaint 
ed  with 

2 

HABAP 

3.228 

HABAP 

33.33 

VJVV 

RCR 
acquaint 
ed  with 
VJVV 

2 

RCR 

acquainted 
with  VJVV 

18.18 

Time  23-28  Net.  Size  10 

degree 

score 

eigenvector 

score 

between. 

score 

cioseness 

score 

MJTR-BS 

5 

MJTR-BS 

65.12 

HDVSAP 

13.88 

9 

MJTR-BS 

61.11 

1 

VJSR-BS 

5 

VJSR-BS 

65.12 

VJSR-BS 

8.333 

VJSR-BS 

61.11 

1 

Secretari 

at  1 

4 

Secretariat  5 

58.83 

7 

MJTR-BS 

8.333 

Secretariat  1 

53.70 

4 

Secretari 

at  5 

4 

Secretariat  1 

58.83 

7 

Secretariat  5 

53.70 

4 

Secretari 

ate 

4 

Secretariat  6 

58.83 

7 

Secretariat  6 

53.70 

4 

HDVSAP 

3 

HDVSAP 

32.75 

5 

HDVSAP 

50 

RCR 

acquainte 
d  with 

2 

HABAP 

7.774 

HABAP 

33.33 

3 

VJW 

MTCR 
acquainte 
d  with 
VJW 

2 

RCR 

acquainted 
with  VJVV 

22.22 

2 

CACR 
acquainte 
d  with 
VJW 

2 

CACR 
acquainted 
with  VJVV 

22.22 

2 

HABAP 

1 

MTCR 

acquainted 

22.22 

p 

with  VJVV 
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Time  29-32  Net.  Size  7 


degree 

score 

eigenvector 

score 

between. 

score 

cioseness 

score 

MJTR-BS 

5 

MJTR-BS 

65.12 

HDVSAP 

33.33 

MJTR-BS 

91.6 

VJSR-BS 

5 

VJSR-BS 

65.12 

VJSR-BS 

20 

VJSR-BS 

91.66 

Secret.  6 

4 

Secretariat  5 

58.83 

MJTR-BS 

20 

Secret.  6 

80.55 

Secret.!  5 

4 

Secretariat  1 

58.83 

Secret.  5 

80.55 

Secrete  ria 

1 1 

4 

Secretariat  6 

58.83 

Secretariat 

1 

80.55 

HDVSAP 

3 

HDVSAP 

32.75 

HDVSAP 

75 

HABAP 

1 

HABAP 

7.774 

HABAP 

50 

Time  33-34  Net.  Size  6 

degree 

score 

eigenvector 

score 

between. 

score 

cioseness 

score 

MJTR-BS 

4 

MJTR-BS 

74.13 

MJTR-BS 

60 

MJTR-BS 

90 

Secret.  6 

3 

Secretariat  5 

67.61 

HDVSAP 

40 

Secret.  6 

76.66 

Secretaria 

3 

Secretariat  1 

67.61 

Secretariat 

76.66 

t5 

5 

Secret.  1 

3 

Secretariat  6 

67.61 

Secret.  1 

76.66 

HDVSAP 

2 

HDVSAP 

26.73 

HDVSAP 

70 

HABAP 

1 

HABAP 

8.632 

HABAP 

50 

Time  35-37  Net.  Size  5 

degree 

score 

eigenvector 

score 

between. 

score 

cioseness 

score 

MJTR-BS 

4 

MJTR-BS 

74.04 

MJTR-BS 

50 

MJTR-BS 

100 

Secret.  5 

3 

Secretariat  5 

68.17 

Secret.  5 

87.5 

Secret.  1 

3 

Secretariat  1 

68.17 

Secret.  1 

87.5 

Secret.  6 

3 

Secretariat  6 

68.17 

Secret.  6 

87.5 

HDVSAP 

1 

HDVSAP 

23.99 

HDVSAP 

62.5 

Time  38  Net.  Size  4 

degree 

score 

eigenvector 

score 

between. 

score 

cioseness 

score 

MJTR-BS 

3 

MJTR-BS 

86.49 

MJTR-BS 

66.67 

MJTR-BS 

100 

Secret.  1 

2 

Secretariat  1 

73.92 

Secret.  1 

83.33 

Secret.  6 

2 

Secretariat  6 

73.92 

Secret.  6 

83.33 

HDVSAP 

1 

HDVSAP 

39.85 

HDVSAP 

66.66 
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D. 


TOPOGRAPHICAL  MEASURES  AND  CENTRALIZATION 


Time  n=quarter  ==>38 

Time 

1-2 

Time 

3-4 

Time 

5 

size 

27 

size 

19 

size 

17 

Avg.  degree 

5.7 

Avg.  degree 

5 

Avg. degree 

4.8 

Density 

0.22 

Density 

0.28 

Density 

0.3 

Degree  centraiization  (%) 

17.54 

Degree  centraiization 

18.30 

Degree  centraiization 

22.50 

Degree  standard  deviation 

2.01 

Degree  standard  deviation 

2.33 

Degree  standard  deviation 

2.60 

Eigenvector  centraiization  (%) 

42.45 

Eigenvector  centraiization 

38.99 

Eigenvector  centraiization 

37.19 

Eigenvector  standard  deviation  (norm.) 

20.39 

Eigenvector  standard  deviation  (norm.) 

22.99 

Eigenvector  standard  deviation  (norm.) 

23.64 

Betweenness  centraiization  (%) 

50.72 

Betweenness  centraiization 

61.18 

Betweenness  centraiization 

46.56 

Betweenness  standard  deviation 
(norm.) 

11.59 

Betweenness  standard  deviation 
(norm.) 

16.25 

Betweenness  standard  deviation 
(norm.) 

14.27 

Cioseness  centraiization  (%) 

38.02 

Cioseness  centraiization 

38.13 

Cioseness  centraiization 

37.27 

Cioseness  standard  deviation  (norm.) 

6.49 

Cioseness  standard  deviation  (norm.) 

8.99 

Cioseness  standard  deviation  (norm.) 

16.00 

Ciustering  Coefficient  (wtd) 

0.66 

Ciustering  Coefficient  (wtd) 

0.79 

Ciustering  Coefficient  (wtd) 

0.87 

Time 

6-7 

Time 

8-12 

Time 

13-21 

size 

15 

size 

14 

size 

13 

Avg.  degree 

4.4 

Avg.  degree 

4 

Avg. degree 

4 

Density 

0.31 

Density 

0.3 

Density 

0.34 

Degree  centraiization  (%) 

21.43 

Degree  centraiization 

26.92 

Degree  centraiization 

28.03 

Degree  standard  deviation 

2.09 

Degree  standard  deviation 

2.39 

Degree  standard  deviation 

2.41 

Eigenvector  centraiization  (%) 

41.02 

Eigenvector  centraiization 

39.88 

Eigenvector  centraiization 

37.54 

Eigenvector  standard  deviation  (norm.) 

24.83 

Eigenvector  standard  deviation  (norm.) 

25.32 

Eigenvector  standard  deviation  (norm.) 

25.06 

Betweenness  centraiization  (%) 

40.11 

Betweenness  centraiization 

15.68 

Betweenness  centraiization 

9.34 

Betweenness  standard  deviation 
(norm.) 

14.12 

Betweenness  standard  deviation 
(norm.) 

5.68 

Betweenness  standard  deviation 
(norm.) 

3.68 

Cioseness  centraiization  (%) 

34.97 

% 

Cioseness  centraiization 

47.46 

% 

Cioseness  centraiization 

48.16 

% 

Cioseness  standard  deviation  (norm.) 

16.09 

Cioseness  standard  deviation  (norm.) 

19.86 

Cioseness  standard  deviation  (norm.) 

21.09 

Ciustering  Coefficient  (wtd) 

0.85 

Ciustering  Coefficient  (wtd) 

0.90 

Ciustering  Coefficient  (wtd) 

0.90 

103 


Topographical  Measures  and  Centralization  (continued) 


Time 

22 

Time 

23-28 

Time 

29-32 

size 

12 

size 

10 

size 

7 

Avg.  degree 

4.3 

Avg.  degree 

3.2 

Avg.  degree 

3.7 

Density 

0.39 

Density 

0.35 

Density 

0.61 

Degree  centraiization  (%) 

29.09 

Degree  centraiization 

25.00 

Degree  centraiization 

30.00 

Degree  standard  deviation 

2.06 

Degree  standard  deviation 

1.33 

Degree  standard  deviation 

1.28 

Eigenvector  centraiization  (%) 

37.76 

Eigenvector  centraiization 

50.65 

Eigenvector  centraiization 

30.58 

Eigenvector  standard  deviation  (norm.)  24.47  Eigenvector  standard  deviation  (norm.)  28.18  Eigenvector  standard  deviation  (norm.)  19.90 

Betweenness  centraiization  (%) 

10.91 

Betweenness  centraiization 

12.04 

Betweenness  centraiization 

26.67 

Betweenness  standard  deviation  (norm.)  4.59  Betweenness  standard  deviation  (norm.)  4.88  Betweenness  standard  deviation  (norm.)12.78 

Cioseness  centraiization  (%) 

46.28 

Cioseness  centraiization 

41.98 

Cioseness  centraiization 

33.61 

Cioseness  standard  deviation  (norm.) 

19.21 

Cioseness  standard  deviation  (norm.) 

15.61 

Cioseness  standard  deviation  (norm.) 

13.01 

Ciustering  Coefficient  (wtd) 

0.86 

Ciustering  Coefficient  (wtd) 

0.82 

Ciustering  Coefficient  (wtd) 

0.81 

Time 

33-34 

Time 

35-37 

Time 

38 

size 

6 

size 

5 

size 

4 

Avg.  degree 

2.6 

Avg.  degree 

2.8 

Avg.  degree 

2 

Density 

0.53 

Density 

0.7 

Density 

0.66 

Degree  centraiization  (%) 

40.00 

Degree  centraiization 

50.00 

Degree  centraiization 

66.67 

Degree  standard  deviation 

0.94 

Degree  standard  deviation 

0.98 

Degree  standard  deviation 

0.71 

Eigenvector  centraiization  (%) 

47.93 

Eigenvector  centraiization 

33.83 

Eigenvector  centraiization 

56.62 

Eigenvector  standard  deviation  (norm.)  24.97  Eigenvector  standard  deviation  (norm.)  18.40  Eigenvector  standard  deviation  (norm.)  17.34 

Betweenness  centraiization  (%) 

52.00 

Betweenness  centraiization 

50.00 

Betweenness  centraiization 

66.67 

Betweenness  standard  deviation  (norm.)24.27Betweenness  standard  deviation  (norm.)20.00Betweenness  standard  deviation  (norm.)28.87 

Cioseness  centraiization  (%) 

45.00 

Cioseness  centraiization 

43.75 

Cioseness  centraiization 

55.56 

Cioseness  standard  deviation  (norm.) 

12.02 

Cioseness  standard  deviation  (norm.) 

12.25 

Cioseness  standard  deviation  (norm.) 

11.79 

Ciustering  Coefficient  (wtd) 

0.75 

Ciustering  Coefficient  (wtd) 

0.80 

Ciustering  Coefficient  (wtd) 

0.60 
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E.  NETWORK  TRANSFORMATION  OVER  TIME 
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F 


SOCIAL  NETWORK  CHANGE  DETECTION 


Betweenness  network  centralization  •  Change  Detection 


Eigenvector  network  centralization  >  Change  Detection 
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Value 


Social  Network  Change  Detection  (continued) 


Clustering  Coefficient  -  Change  Detection 


Decrease  Increase 
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APPENDIX  3.  FERNANDO  LONDONO  CASE  STUDY 


A.  LIST  OF  OPEN  SOURCES 


Source 

Title  (in  original  language) 

Date 

Internet  link 

El 

Espectador 

<j,Porque  contra  Fernando 
Londono  Hoyos?  [Why  against 
Fernando  Londono  Hoyos?] 

May  15, 
2012 

http://www.elespectador.com/noticias/ 

judicial/contra-fernando-londono-hoyos- 

articulo-346485 

Caracol 

Gobierno  Confirma  Que 
Fernando  Londono  Habria 
Recibido  Amenazas 
[Government  confirms  that 
Londono  had  received  threats] 

May  16, 
2012 

http://www.caracol.com.co/noticias/ 

judiciales/gobierno-confirma-que-fernando- 

londono-habia-recibido-amenazas/ 

201 2051 6/nota/1 688946.aspx 

Las  Fare  asaltaron  carro  de 
valores  en  la  via  Santander  de 

El  Pais 

Quilichao-Cali  [The  FARC 
assaulted  a  vehicle 
transporting  valuables  on  the 
way  between  Santander  and 

October 

24,2012 

http://www.elpais.com.co/elpais/judicial/ 

noticias/dos-policias-heridos-dejo-ataque- 

carro-valores-panamericana 

Cali] 

FARC  secuestraron  a  dos 

Semana 

policias  en  Valle  [The  FARC 
kidnapped  two  policemen  in 
Valle] 

January 

26,2013 

http://m. semana.com/nacion/articulo/farc- 
secuestraron-dos-policias-valle/330948-3 

Semana 

<j,Y  Que  Tal  Este  Delincuente? 
[And,  what  about  this 
criminal?] 

February 
2,  2013 

http://www.semana.com/nacion/articulo/y- 
que-este-delincuente/331 454-3 

Caracol 

Primeras  Imagenes  De  La 

Liberacion  De  Dos  Policias 
Secuestrados  Por  FARC  [First  February 
images  of  the  release  of  two  15,2013 
policemen  kidnapped  by  the 

FARC] 

http://www.noticiascaracol.com/nacion/ 

primeras-imagenes-de-la-liberacion-de-dos- 

policias-secuestrados-por-farc 

Caracol 

Escrito  de  acusacion  [Bill  of 
indictment] 

February 

21,2013 

http://www.caracol.com.co/docs/ 

201302mareb1a63a.docx 
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List  of  Open  Sources  (continued) 


Source 

Title  (in  original  language) 

Date 

internet  iink 

‘La  Teofilo  pago  $1,000  millones 

El 

por  atentado  a  Londono’  [The 

March  1, 

h  ttp  ://www .  e  1  tie  m  po .  CO  m/a  rch  i  vo/ 

Tiempo 

CMTF  paid  $1 .000  million  for  the 

2013 

documento/CMS-1 2626865 

attack  on  Londono] 

Fiscalia 
General 
de  la 
Nacion 

Acusan  a  implicados  en  atentado 
en  contra  del  exministro 
Fernando  Londono  [Accused 
some  involved  in  the  attack  on 
former  Minister  Londono] 

June  27, 
2013 

http://www.fiscalia.gov.co/colombia/ 

noticias/acusan-a-implicados-en- 

atentado-en-contra-del-exministro- 

fernando-londono/ 

El 

Tiempo 

‘Musas’  de  las  Fare  cayeron  por 
una  ‘SIM  card’  [‘Muses’  from  the 
FARC  fall  because  of  a  SIM  card] 

July  9, 
2013 

http://www.eltiempo.com/justicia/captura- 
de-las-musas-de-las-farc_1 2922354-4 

Fiscalia 
General 
de  la 
Nacion 

Legalizadas  capturas  por 
atentado  en  contra  del  ex 
ministro  Londono  Hoyos  [Legal 
capture  of  those  involved  in 
attack  on  Londono] 

August  29, 
2013 

http://www.fiscalia.gov.co/colombia/ 

noticias/legalizadas-capturas-por- 

atentado-en-contra-del-ex-ministro- 

londono-hoyos/ 

Carta  Del  Paisa,  Clave  En 

Proceso  Por  Atentado  a 

El 

Exministro  Londono  [Letter  from 

November 

http://www.eltiempo.com/archivo/ 

Tiempo 

El  Paisa,  key  in  investigation  of 

18,  2013 

documento/CMS-1 3200392 

attack  on  former  Minister 

Londono] 

Diario  del 
Huila 

Enviadas  a  la  carcel  ‘fuerzas 
especiales’  de  las  Fare  [To  jail 
FARC  special  forces] 

February 
26, 2014 

http://diariodelhuila.com/judicial/ 

enviadas-a-la-carcel-’fuerzas- 

especiales’-de-las-farc- 

cdgint20140226073620127 

El 

Tiempo 

El  fin  de  la  alianza  de  las  Fare 
con  el  ‘parche  de  Zuley’  [The  end 
of  the  alliance  between  the 
FARC  and  the  Parche  El  Zuley] 

May  1, 
2014 

http://www.eltiempo.com/justicia/alianza- 
de-las-farc-con-el-parche-de-zuley-llego- 
a-su-fin_1 391 6279-4 
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B.  TIMELINE 


Date 

Type  of  Event 

Description 

Timeframe 

AumoM 

Planning  of  the 
attack 

The  PEZ  members  travel  from  Cali  to  Bogota 
for  gathering  information  on  the  target 

1 

4/25/2012 

Meeting 

between 

criminals 

The  PEZ  criminals  contacted  another  criminal 
organization  from  Bogota 

1 

5/7/2012 

Planning  of  the 
attack 

The  PEZ  Travels  back  to  Cali  in  order  to 
coordinate  the  acquisition  of  explosives 

1 

5/6/2012 

Meeting 

between 

criminals 

The  PEZ  contacted  another  criminal  group  from 
Cali 

1 

5/7/2012 

Logistics 

Criminals  travel  from  Cali  to  Bogota  for 
planning  the  terrorist  attack 

2 

5/9/2012 

Logistics 

Explosives  prepared  in  Cali  arrived  to  Bogota 

2 

5/9/2012 

Mobilization 

Bomber  and  driver  arrived  to  Bogota  from  Cali 

2 

5/14/2012 

Planning  of  the 
attack 

Final  arrangements  for  terrorist  attack 

2 

5/15/2012 

Execution  of 
the  operation 

Terrorist  attack  against  Fernando  Londoho 

2 

6/1/2012 

Network’s 

dispersion 

Terrorists  escape  to  Cali  city 

3 

8/28/2012 

Law 

enforcement 

operation 

Terrorists  from  Bogota  were  arrested 

5 

6/12/2013 

Law 

enforcement 

operation 

Terrorists  arrested  during  Police  operation  - 
they  belong  to  the  Sixth  Front 

15 

8/18/2013 

Law 

enforcement 

operation 

Terrorists  KIA  during  police  operation 

17 

12/15/2013 

Law 

enforcement 

operation 

Terrorists  KIA  and  arrested  during  Police 
operation 

21 

2/24/2014 

Law 

enforcement 

operation 

Terrorists  arrested  during  Police  operation 

23 
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c. 


CENTRALITY  MEASURES  OVERTIME 


TOP  10  X  TIME 

Time  1- 

2 -Net.  Size  11 

DEGREE 

Score 

EIGENVECTOR 

Score 

BETWEENNESS 

Score 

CLOSENESS 

Score 

DF-TM 

9 

DF-TM 

52.07 

HDVSAP 

20 

DF-TM 

95 

W-TM 

9 

W-TM 

52.07 

DF-TM 

19.26 

W-TM 

95 

LAM REG 

8 

LAMREG 

50.29 

W-TM 

19.26 

LAMREG 

88.333 

UCBA 

7 

UCBA 

47.7 

LAMREG 

3.704 

UCBA 

83.333 

CARGB 

7 

CARGB 

47.7 

CARGB 

83.333 

NACH 

7 

NACH 

47.7 

NACH 

83.333 

FCAF 

7 

FCAF 

47.7 

FCAF 

83.333 

CAPI 

7 

CAPI 

47.7 

CAPI 

83.333 

HDVSAP 

3 

JLGB 

21.34 

HDVSAP 

65 

JLGB 

3 

HDVSAP 

14.67 

JLGB 

63.333 

Time  3- 

-5  Net.  Size  25 

DEGREE 

Score 

EIGENVECTOR 

Score 

BETWEENNESS 

Score 

CLOSENESS 

Score 

DF-TM 

13 

W-TM 

54.81 

AMPAJ 

38.06 

DF-TM 

77.083 

W-TM 

13 

LAMREG 

52.89 

DF-TM 

32.6 

W-TM 

77.083 

LAM REG 

12 

DF-TM 

51.24 

W-TM 

19.8 

LAMREG 

74.306 

AMPAJ 

10 

UCBA 

40.97 

LAMREG 

14.55 

AMPAJ 

70.139 

UCBA 

7 

CARGB 

40.97 

HDVSAP 

11.41 

UCBA 

59.028 

CARGB 

7 

NACH 

40.97 

JLGB 

2.826 

CARGB 

59.028 

FCAF 

7 

FCAF 

40.97 

MAPSP 

2.198 

FCAF 

59.028 

CAPI 

7 

CAPI 

40.97 

Give 

1.691 

CAPI 

59.028 

NACH 

7 

AMPAJ 

26.5 

RCGM 

1.147 

NACH 

59.028 

Give 

6 

JLGB 

21.42 

HDVSAP 

56.944 

Time  6- 

15  Net.  Size  20 

DEGREE 

Score 

EIGENVECTOR 

Score 

BETWEENNESS 

Score 

CLOSENESS 

Score 

AMPAJ 

10 

AMPAJ 

58.77 

AMPAJ 

43.59 

AMPAJ 

75.439 

DF-TM 

8 

W-TM 

47.32 

DF-TM 

31.95 

DF-TM 

71.053 

W-TM 

8 

LAMREG 

43.85 

W-TM 

15.67 

W-TM 

71.053 

LAM REG 

7 

DF-TM 

40.53 

HDVSAP 

14.33 

LAMREG 

67.544 

Give 

6 

Give 

39.41 

LAMREG 

10.72 

HDVSAP 

58.772 

HDVSAP 

5 

ceve 

35.07 

MAPSP 

3.548 

Give 

58.333 

SPRVP 

5 

SPRVP 

35.07 

JLGB 

3.099 

JLGB 

57.895 

ESPG 

5 

DAPR 

35.07 

Give 

2.729 

ESPG 

55.702 

ceve 

5 

ESPG 

35.07 

ceve 

55.702 

DAPR 

5 

JLGB 

29.51 

SPRVP 

55.702 
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Centrality  Measures  times  16-24  (continued) 


TOP  10  X  TIME 
Time  16-17  Net.  Size  15 


DEGREE 

Score 

EIGENVECTOR 

Score 

BETWEENNESS 

Score 

CLOSENESS 

Score 

DF-TM 

8 

W-TM 

63.83 

DF-TM 

40 

DF-TM 

78.571 

W-TM 

8 

LAMREG 

58.35 

HDVSAP 

21.5 

W-TM 

78.571 

LAM REG 

7 

DF-TM 

51.98 

W-TM 

17.66 

LAMREG 

73.81 

HDVSAP 

5 

RCGM 

44.32 

AMPAJ 

16.23 

HDVSAP 

67.857 

RCGM 

5 

Decs 

38.84 

LAMREG 

12.13 

AMPAJ 

66.667 

AMPAJ 

5 

HAJPE 

38.84 

RCGM 

3.48 

RCGM 

63.095 

HAJPE 

4 

AMPAJ 

37.79 

MAPSP 

3.297 

HAJPE 

57.143 

Decs 

4 

HDVSAP 

34.46 

Decs 

57.143 

JCG 

3 

JLGB 

32.94 

JLGB 

57.143 

FCMP 

3 

JCG 

15.81 

MAPSP 

53.571 

Time  18- 

21  Net.  Size  13 

DEGREE 

Score 

EIGENVECTOR 

Score 

BETWEENNESS 

Score 

CLOSENESS 

Score 

DF-TM 

7 

W-TM 

64.55 

DF-TM 

44.7 

DF-TM 

79.167 

W-TM 

7 

LAMREG 

58.41 

HDVSAP 

33.84 

W-TM 

79.167 

LAM REG 

6 

RCGM 

50.23 

W-TM 

18.69 

LAMREG 

72.222 

HDVSAP 

5 

DF-TM 

49.81 

LAMREG 

10.35 

HDVSAP 

70.833 

RCGM 

5 

HAJPE 

44.09 

RCGM 

6.061 

RCGM 

66.667 

HAJPE 

4 

Decs 

44.09 

HAJPE 

59.722 

Decs 

4 

HDVSAP 

36.4 

JLGB 

59.722 

FCMP 

3 

JLGB 

35.06 

Decs 

59.722 

ARAP 

3 

JCG 

17.01 

FCMP 

55.556 

JCG 

3 

FCMP 

17.01 

ARAP 

55.556 

Time  22- 

-23  Net.  Size  9 

DEGREE 

Score 

EIGENVECTOR 

Score 

BETWEENNESS 

Score 

CLOSENESS 

Score 

W-TM 

6 

W-TM 

66.66 

HDVSAP 

46.43 

W-TM 

87.5 

LAM REG 

5 

RCGM 

61.32 

W-TM 

32.14 

RCGM 

81.25 

RCGM 

5 

LAMREG 

60.68 

RCGM 

16.07 

LAMREG 

77.083 

HDVSAP 

4 

Decs 

55.34 

LAMREG 

5.357 

HDVSAP 

75 

HAJPE 

4 

HAJPE 

55.34 

HAJPE 

70.833 

Decs 

4 

HDVSAP 

32.36 

Decs 

70.833 

JLGB 

2 

JLGB 

28.88 

JLGB 

58.333 

MAPSP 

1 

MAPSP 

7.338 

MAPSP 

47.917 

FGRC 

1 

FGRC 

7.338 

FGRC 

47.917 

Time  24  Net.  Size  4 

DEGREE 

Score 

EIGENVECTOR 

Score 

BETWEENNESS 

Score 

CLOSENESS 

Score 

HDVSAP 

2 

- 

- 

HDVSAP 

33.33 

HDVSAP 

66.667 

MAPSP 

1 

- 

- 

MAPSP 

50 

FGRC 

1 

- 

- 

FGRC 

50 

JLGB 

0 

- 

- 

JLGB 

0 
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D. 


TOPOGRAPHICAL  MEASURES  AND  CENTRALIZATION 


Time  n=month  ==>24 

Time 

1-2 

Time 

3-5 

Time 

6-15 

size 

11 

size 

25 

size 

20 

Avg.  degree 

6.1 

Avg.  degree 

5.8 

Avg.  degree 

4.8 

Density 

0.61 

Density 

0.24 

Density 

0.25 

Degree  centralization 

34.44  % 

Degree  centralization 

32.43  % 

Degree  centralization 

30.41  % 

Degree  standard  deviation 

2.52 

Degree  standard  deviation 

3.16 

Degree  standard  deviation 

2.14 

Eigenvector  centralization 

20.74  % 

Eigenvector  centralization 

42.17% 

Eigenvector  centralization 

41.55  % 

Eigenvector  standard  deviation 
(norm.) 

16.84 

Eigenvector  standard  deviation 
(norm.) 

17.01 

Eigenvector  standard  deviation 
(norm.) 

14.02 

Betweenness  centralization 

15.78% 

Betweenness  centralization 

34.46  % 

Betweenness  centralization 

39.17% 

Betweenness  standard  deviation 
(norm.) 

8.55 

Betweenness  standard  deviation 
(norm.) 

10.28 

Betweenness  standard  deviation 
(norm.) 

11.63 

Closeness  centralization 

37.65  % 

Closeness  centralization 

45.17% 

Closeness  centralization 

41.66  % 

Closeness  standard  deviation  (norm.) 

14.79 

Closeness  standard  deviation  (norm.) 

9.65 

Closeness  standard  deviation  (norm.) 

8.96 

Clustering  Coefficient  (wtd) 

0.85 

Clustering  Coefficient  (wtd) 

0.62 

Clustering  Coefficient  (wtd) 

0.58 

Time 

16-17 

Time 

18-21 

Time 

22-23 

size 

15 

size 

13 

size 

9 

Avg.  degree 

4.2 

Avg.  degree 

4 

Avg.  degree 

3.5 

Density 

0.3 

Density 

0.33 

Density 

0.44 

Degree  centralization 

30.77  % 

Degree  centralization 

29.55  % 

Degree  centralization 

39.29  % 

Degree  standard  deviation 

2.02 

Degree  standard  deviation 

1.88 

Degree  standard  deviation 

1.71 

Eigenvector  centralization 

46.45  % 

Eigenvector  centralization 

45.77  % 

Eigenvector  centralization 

43.45  % 

Eigenvector  standard  deviation 
(norm.) 

17.47 

Eigenvector  standard  deviation 
(norm.) 

18.67 

Eigenvector  standard  deviation 
(norm.) 

21.99 

Betweenness  centralization 

34.69  % 

Betweenness  centralization 

38.95  % 

Betweenness  centralization 

39.73  % 

Betweenness  standard  deviation 
(norm.) 

11.36 

Betweenness  standard  deviation 
(norm.) 

14.26 

Betweenness  standard  deviation 
(norm.) 

16.21 

Closeness  centralization 

40.62  % 

Closeness  centralization 

39.45  % 

Closeness  centralization 

45.76  % 

Closeness  standard  deviation  (norm.) 

10.43 

Closeness  standard  deviation  (norm.) 

10.92 

Closeness  standard  deviation  (norm.) 

13.34 

Clustering  Coefficient  (wtd) 

0.53 

Clustering  Coefficient  (wtd) 

0.59 

Clustering  Coefficient  (wtd) 

0.67 
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Topographical  Measures  and  Centralization  (continued) 


Time 

24 

size 

4 

Avg.  degree 

1 

Density 

0.33 

Degree  centralization 

66.67  % 

Degree  standard  deviation 

0.71 

Eigenvector  centralization 

Eigenvector  standard  deviation 

(norm.) 

Betweenness  centralization 

33.33  % 

Betweenness  standard  deviation 
(norm.) 

14.43 

Closeness  centralization 

83.33  % 

Closeness  standard  deviation  (norm.) 

25.00 

Clustering  Coefficient  (wtd) 

0.00 
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E. 


NETWORK  TRANSFORMATION  OVER  TIME 


FERNANDO  LONDONO  -  24  TIMES 


116 


F. 


SOCIAL  NETWORK  CHANGE  DETECTION 


Eigenvector  networfc  centralization  -  Change  Detection 
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Betweenness  network  centralization  -  Change  Detection 


Social  Network  Change  Detection  (continued) 


Clustering  Coefficient  -  Change  Detection 


Decrease  — Increase 
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